This vulnerability exists in the access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges who can access the system over HTTP, enabling compromise of the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation details for this version.

Successful exploitation can lead to full compromise of Oracle Hyperion Data Relationship Management, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product instance.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory mentions many patches but does not explicitly confirm a patch for this specific vulnerability and version. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.