This vulnerability in Oracle Hyperion Data Relationship Management (version 11.2.25.0.000) affects the access and security component, enabling an unauthenticated attacker with network access over HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. There is no evidence of known exploits in the wild. The vendor advisory from Oracle references this vulnerability as part of their August 2026 Critical Security Patch Update but does not explicitly confirm patch availability for this specific version or vulnerability.

The vulnerability allows unauthorized remote attackers to access sensitive data within Oracle Hyperion Data Relationship Management without authentication. This can lead to exposure of critical data, potentially compromising confidentiality. There is no reported impact on data integrity or availability. No known active exploitation has been reported.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update process. However, the vendor advisory does not explicitly confirm a patch for this specific vulnerability or version. Therefore, check the Oracle Critical Security Patch Update advisory for August 2026 for the latest patch availability and installation instructions. Until patched, restrict network access to the affected service to trusted users only.