This vulnerability in Oracle Hyperion Data Relationship Management (version 11.2.25.0.000) allows an unauthenticated attacker with network access over HTTPS to compromise the system. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible data within the product, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control).

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to critical data managed by Oracle Hyperion Data Relationship Management. The attacker may also perform unauthorized modifications such as updates, inserts, or deletions on some of the accessible data. This compromises confidentiality and integrity of the data but does not affect system availability.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and other vulnerabilities. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of applying available Oracle patches without delay and remaining on actively supported versions. No indication is given that the vulnerability is already mitigated or requires no action.