This vulnerability affects Oracle Hyperion Data Relationship Management (component: Access and security) version 11.2.25.0.000. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the system. The scope of impact extends beyond the product itself, potentially affecting other Oracle products. Exploitation can result in unauthorized creation, deletion, or modification of critical data, leading to complete unauthorized access to all data accessible by the product. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact without availability impact.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Data Relationship Management, as well as unauthorized access to all data accessible by the product. The vulnerability may also significantly impact additional Oracle products due to scope change. The confidentiality and integrity of data are highly impacted, but availability is not affected.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of staying on actively supported versions and applying patches without delay. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.