Description
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Takeover
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in a component responsible for access and security. An attacker who is only lightly privileged and can reach the system over HTTP can compromise the product, leading to full takeover. The effect is significant, compromising all confidential information and the integrity and availability of the service.

Affected Systems

Oracle Hyperion Data Relationship Management version 11.2.26.0.000 is affected. This includes installations that expose the HTTP interface for the product.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 indicates high severity, with impacts to confidentiality, integrity, and availability. The EPSS score is below 1%, suggesting low current exploitation likelihood, but the attack vector is network‑based, requires only low privileges, and no user interaction, making it potentially easy to leverage once discovered. The vulnerability is not listed in CISA KeV, so no public exploits are confirmed yet, but monitoring and quick patching remain critical.

Generated by OpenCVE AI on September 20, 2026 at 06:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Hyperion Data Relationship Management 11.2.26.0.000
  • If a patch is unavailable, restrict HTTP access to trusted networks or disable the exposed service entirely
  • Continuously monitor Oracle security advisories for updates or experimental workarounds

Generated by OpenCVE AI on September 20, 2026 at 06:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 07:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Takeover in Oracle Hyperion Data Relationship Management

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Hyperion Data Relationship Management Remote Takeover via HTTP
Weaknesses CWE-284

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Title Hyperion Data Relationship Management Remote Takeover via HTTP
Weaknesses CWE-269
CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Data Relationship Management
CPEs cpe:2.3:a:oracle:hyperion_data_relationship_management:11.2.26.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Data Relationship Management
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Data Relationship Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:00:21.975Z

Reserved: 2026-09-08T21:49:12.397Z

Link: CVE-2026-87140

cve-icon Vulnrichment

Updated: 2026-09-17T12:57:53.135Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:19:01.267

Modified: 2026-09-22T18:01:09.383

Link: CVE-2026-87140

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T07:00:08Z

Weaknesses
  • CWE-269

    Improper Privilege Management