This vulnerability affects Oracle Hyperion Data Relationship Management 11.2.25.0.000 and is exploitable remotely without authentication via SOAP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact.

An attacker can remotely and unauthenticatedly compromise Oracle Hyperion Data Relationship Management, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. This represents a significant confidentiality and integrity breach, potentially affecting business-critical information managed by the software.

Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. However, the vendor advisory does not explicitly confirm the availability of a patch for this specific vulnerability. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.