A high-severity access control vulnerability in Oracle Hyperion Data Relationship Management allows a low-privileged user to achieve full system compromise.

This is an access control vulnerability that allows a low-privileged attacker with HTTP network access to compromise the application. It is characterized as a flaw in the Access and Security component.

The vulnerability allows a low-privileged attacker to achieve full system takeover, posing a severe risk to data confidentiality and integrity. With a CVSS score of 8.8, this flaw could lead to the exposure of sensitive financial or relationship data managed by the system, as well as unauthorized modification of critical business logic.

Immediate Action: Apply the relevant Oracle Critical Patch Update for August 2026 immediately.

Proactive Monitoring: Monitor access logs for unusual HTTP requests or attempts by low-privileged accounts to access administrative or restricted functions within the Hyperion suite.

Compensating Controls: Restrict network access to the Hyperion application to trusted subnets only, utilizing a VPN or internal network segmentation to prevent external exploitation.

Public Exploit Available: Unknown

This vulnerability is critical due to the potential for full system takeover. Organizations utilizing Oracle Hyperion should prioritize the application of the August 2026 security updates to neutralize the threat posed by low-privileged account exploitation.