This vulnerability affects Oracle Hyperion Data Relationship Management component 'Access and security' in version 11.2.25.0.000. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 score of 8.5, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is part of a broader set of security issues addressed in Oracle's August 2026 Critical Security Patch Update. Oracle strongly recommends applying the provided patches promptly to mitigate this and other vulnerabilities.

Successful exploitation can lead to complete compromise of Oracle Hyperion Data Relationship Management, affecting confidentiality, integrity, and availability of the system. The vulnerability also has scope change implications, potentially impacting additional Oracle products beyond Hyperion Data Relationship Management.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches without delay to remediate this issue. Oracle strongly recommends remaining on actively-supported versions and promptly applying all security patches. Patch status is confirmed as fixed in the August 2026 update; no further action beyond patching is required.