This vulnerability affects the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized creation, deletion, or modification of critical or all accessible data within the product. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly state patch availability for this version.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Hyperion Data Relationship Management. This results in a high impact on confidentiality and integrity of the data. There is no reported impact on system availability. No known active exploitation in the wild has been reported.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. However, the vendor advisory does not explicitly confirm the availability of a patch for version 11.2.25.0.000. Users should consult the Oracle Critical Security Patch Update advisory for August 2026 for the latest patch availability and installation instructions. Maintaining actively supported versions and timely patching is advised to mitigate this vulnerability.