This vulnerability exists in the access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. It is easily exploitable by unauthenticated attackers over the network via TCP, allowing them to compromise the system fully. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical impact on confidentiality, integrity, and availability. The scope of impact may extend beyond the product itself to other Oracle products. Oracle's August 2026 Critical Security Patch Update advisory references multiple patches but does not explicitly confirm a patch for this exact version and vulnerability in the provided excerpt. No known exploits in the wild have been reported at this time.

Successful exploitation can lead to complete takeover of Oracle Hyperion Data Relationship Management, compromising confidentiality, integrity, and availability. The vulnerability is exploitable without authentication and requires only network access via TCP. The impact may extend to other Oracle products due to the scope change mentioned.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Although the vendor advisory references a Critical Security Patch Update released in August 2026, it does not explicitly confirm a patch for this vulnerability in version 11.2.25.0.000. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. No vendor advisory states that no action is required or that the issue is already mitigated.