This vulnerability affects Oracle Hyperion Data Relationship Management component 'Access and security' in version 11.2.25.0.000. It is easily exploitable by a high privileged attacker over the network via HTTPS, resulting in a complete compromise of the product. The vulnerability has a CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Successful exploitation can lead to full takeover of Oracle Hyperion Data Relationship Management and may impact other Oracle products. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability and recommends applying patches promptly.

Successful exploitation allows an attacker with high privileges and network access via HTTPS to fully compromise Oracle Hyperion Data Relationship Management, affecting confidentiality, integrity, and availability. The vulnerability's scope change means it may also impact additional Oracle products beyond the initially affected component.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided patches without delay. Oracle recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks.