This vulnerability in Oracle Hyperion Data Relationship Management (version 11.2.25.0.000) involves an easily exploitable flaw in the access and security component. An unauthenticated attacker with network access via HTTP can compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) highlights that the attack can be performed remotely with low complexity, no privileges, and no user interaction, impacting confidentiality but not integrity or availability. The vendor advisory references Oracle's Critical Security Patch Update for August 2026 but does not explicitly confirm a patch for this specific vulnerability in the provided content.

Successful exploitation allows an unauthenticated remote attacker to access critical or all data accessible by Oracle Hyperion Data Relationship Management 11.2.25.0.000, compromising confidentiality. There is no impact on integrity or availability according to the CVSS vector. No known exploits in the wild have been reported.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update (August 2026). However, the provided advisory content does not explicitly confirm a patch for this specific vulnerability. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Until a patch is confirmed and applied, restrict network access to the affected service where possible.