This vulnerability affects the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. It permits an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact without affecting availability. The vulnerability is listed in Oracle's August 2026 Critical Security Patch Update advisory, which contains numerous patches across Oracle products, but the specific patch status for this version is not explicitly stated in the advisory content provided.

Successful exploitation allows an unauthenticated attacker to gain unauthorized creation, deletion, or modification access to critical data within Oracle Hyperion Data Relationship Management. This can lead to full compromise of all accessible data in the affected product version, severely impacting confidentiality and integrity. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. Customers are strongly advised to apply the relevant security patches promptly as per Oracle's guidance to mitigate this vulnerability. Since the vendor advisory does not explicitly confirm patch availability for version 11.2.25.0.000 in the provided data, users should consult the official Oracle security advisory and patch documentation for the latest remediation status and instructions. Maintaining up-to-date patches is critical to prevent exploitation.