This vulnerability in Oracle Hyperion Data Relationship Management (version 11.2.23.0.000) allows an unauthenticated remote attacker to compromise the system via HTTP. Successful exploitation can lead to unauthorized access to critical or all accessible data and partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, high confidentiality impact, no integrity impact, and low availability impact. Oracle has acknowledged this vulnerability in its August 2026 Critical Security Patch Update advisory.

An attacker can remotely exploit this vulnerability without authentication to access sensitive data within Oracle Hyperion Data Relationship Management and cause a partial denial of service. This compromises confidentiality significantly and availability to a lesser extent. There is no reported impact on data integrity. No known exploits in the wild have been reported at this time.

Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch availability details should be confirmed via the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.