This vulnerability in Oracle Hyperion Data Relationship Management (component: Access and security) affects version 11.2.25.0.000. It is easily exploitable by unauthenticated attackers over the network via HTTP, enabling unauthorized access to critical or complete data accessible by the product. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability impact. The vendor advisory references the August 2026 Critical Security Patch Update but does not explicitly confirm a patch for this specific vulnerability within the advisory content provided.

Successful exploitation results in unauthorized access to critical or all accessible data in Oracle Hyperion Data Relationship Management, potentially compromising sensitive information. There is no reported impact on data integrity or availability. No known exploits in the wild have been reported to date.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although the vendor advisory does not explicitly confirm a patch for this specific vulnerability, customers should review the August 2026 Critical Security Patch Update documentation and apply relevant patches for Oracle Hyperion Data Relationship Management version 11.2.25.0.000 without delay. Maintaining up-to-date software versions and applying vendor patches is the primary mitigation.