This vulnerability affects Oracle Hyperion Data Relationship Management version 11.2.25.0.000 in the access and security component. It permits a high privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, required high privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has acknowledged the vulnerability and included it in their August 2026 Critical Security Patch Update advisory.

Successful exploitation can lead to complete compromise of Oracle Hyperion Data Relationship Management, affecting confidentiality, integrity, and availability of the system. The vulnerability requires high privileges and network access via HTTP, and is rated medium severity with a CVSS score of 6.6. There are no known exploits in the wild at this time.

Oracle has published a Critical Security Patch Update advisory that addresses this vulnerability among many others. Customers are strongly advised to apply the relevant security patches promptly to mitigate this risk. The vendor advisory does not specify if a separate or immediate patch for this specific vulnerability is available outside the CSPU. Patch status is not yet confirmed explicitly for this version; therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Oracle recommends remaining on actively supported versions and applying security patches without delay.