This vulnerability affects the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. It permits a low privileged attacker with network access via HTTP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. Oracle has acknowledged this vulnerability in its August 2026 Critical Security Patch Update advisory but has not explicitly detailed patch availability for this specific version in the provided content.

Successful exploitation can lead to complete compromise of Oracle Hyperion Data Relationship Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this and other vulnerabilities. Customers are strongly advised to apply the relevant security patches promptly and remain on actively supported versions. Since the product is not a cloud service, remediation requires applying Oracle's patches as per the advisory. Patch status for this specific version is not explicitly confirmed in the advisory; users should consult the Oracle Critical Security Patch Update documentation for detailed patch availability and installation instructions.