This vulnerability affects Oracle Hyperion Data Relationship Management component Access and Security in version 11.2.25.0.000. An unauthenticated attacker who can log on to the underlying infrastructure can exploit this flaw to gain unauthorized access and perform critical data operations such as creation, deletion, or modification. The CVSS vector indicates low attack complexity and no user interaction required, with high confidentiality and integrity impacts but no availability impact. The vulnerability is publicly known and documented with CVE-2026-70894 and is addressed in Oracle's August 2026 Critical Security Patch Update advisory.

Exploitation of this vulnerability can lead to unauthorized full access to all data accessible by Oracle Hyperion Data Relationship Management, including the ability to create, delete, or modify critical data. This compromises confidentiality and integrity of the data managed by the product. There is no reported impact on availability. The vulnerability requires the attacker to have logon access to the infrastructure but does not require authentication within the application itself.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory and strongly recommends that customers apply available security patches without delay. No specific patch link was provided in the input data, so users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Remaining on actively-supported versions and promptly applying security patches is the primary mitigation.