This vulnerability affects Oracle Hyperion Data Relationship Management 11.2.25.0.000 and involves an access and security flaw that allows a low privileged attacker with logon access to the infrastructure to compromise the product. The vulnerability has a CVSS 3.1 score of 7.8 with high impact on confidentiality, integrity, and availability, and a scope change that may affect other Oracle products. Oracle has included a fix for this vulnerability in its August 2026 Critical Security Patch Update. The vendor advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation can result in complete takeover of Oracle Hyperion Data Relationship Management, affecting confidentiality, integrity, and availability of the system. The vulnerability also has a scope change, meaning it may significantly impact additional Oracle products beyond Hyperion Data Relationship Management. The attack requires low privileges but high attack complexity and local access to the infrastructure.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers should apply the official Oracle patches promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.