This vulnerability affects Oracle Hyperion Data Relationship Management (component: Access and security) version 11.2.25.0.000. It is easily exploitable by a low privileged attacker who has logon access to the infrastructure hosting the product. Successful exploitation can result in unauthorized access to critical data or full access to all data accessible by the product. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact. The vulnerability may also affect other Oracle products due to scope change. No known exploits in the wild have been reported. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm patch availability for this specific version.

The vulnerability allows unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Data Relationship Management. This can lead to significant confidentiality breaches. The scope change means that other Oracle products integrated or related to this product may also be impacted. There is no reported impact on integrity or availability.

Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. However, the vendor advisory does not explicitly confirm a patch for this specific vulnerability or version 11.2.25.0.000. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Until a patch is confirmed, restrict logon access to the infrastructure hosting Oracle Hyperion Data Relationship Management to trusted users only.