This vulnerability in Oracle Hyperion Data Relationship Management (version 11.2.25.0.000) involves an access and security flaw that can be exploited by a low privileged attacker over the network via HTTP. Successful exploitation can lead to complete compromise of the product. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to take over Oracle Hyperion Data Relationship Management, resulting in full compromise of confidentiality, integrity, and availability of the affected system.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of applying available patches without delay. Patch availability for this specific version should be confirmed via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or workarounds are specified.