This vulnerability affects Oracle Hyperion Data Relationship Management component 'Access and security' in version 11.2.25.0.000. An unauthenticated attacker with network access via HTTP can exploit this flaw to gain unauthorized access to create, delete, or modify critical data within the product. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and integrity impact but no availability impact. The vulnerability is included in Oracle's August 2026 Critical Security Patch Update, which contains numerous security fixes across Oracle products. Oracle advises customers to remain on supported versions and apply patches without delay.

Successful exploitation results in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Data Relationship Management. This compromises confidentiality and integrity of data but does not affect availability. The vulnerability is exploitable remotely without authentication, increasing risk.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers should apply the relevant patches from Oracle's advisory promptly to remediate this issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch availability details are provided in the Oracle advisory. No alternative mitigations or 'no action required' statements were given.