This vulnerability affects Oracle Hyperion Data Relationship Management component Access and security in version 11.2.25.0.000. It allows a low privileged attacker with network access to exploit an SQL-based vulnerability to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 score of 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N). Attacks may also impact additional Oracle products beyond Hyperion Data Relationship Management due to scope change. No known exploits in the wild have been reported. The vendor advisory is part of Oracle's August 2026 Critical Security Patch Update, which includes many patches across Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Data Relationship Management. It can also result in unauthorized access to all accessible data in the product. The vulnerability affects confidentiality and integrity but not availability. Due to scope change, other Oracle products may be significantly impacted by attacks exploiting this vulnerability.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch availability details are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No specific temporary mitigations are mentioned; patching is the primary remediation.