This vulnerability affects Oracle Hyperion Data Relationship Management (version 11.2.25.0.000) in the Access and Security component. It permits a low privileged attacker with network access via HTTP to compromise the system, contingent on user interaction from a person other than the attacker. The scope of impact may extend beyond the immediate product to other Oracle Hyperion products. The vulnerability can result in unauthorized creation, deletion, or modification of critical data, with high confidentiality and integrity impacts but no availability impact. The CVSS vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Data Relationship Management and potentially other Oracle Hyperion products. This compromises confidentiality and integrity of data but does not affect availability. The attack requires network access and user interaction from a third party, increasing the risk of data compromise and unauthorized access.

Oracle has released a security patch addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply this patch promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond applying the official patch.