This vulnerability affects Oracle Hyperion Data Relationship Management component 'Access and security' in version 11.2.25.0.000. It allows a low privileged attacker with network access via HTTP to gain unauthorized access, enabling creation, deletion, or modification of critical or all accessible data within the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle has published this vulnerability as part of its August 2026 Critical Security Patch Update advisory.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle Hyperion Data Relationship Management. This leads to a high impact on confidentiality and integrity of data managed by the product. There is no impact on availability reported. The vulnerability requires network access and low privileges, making it relatively easy to exploit.

Oracle has included a fix for this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.