This vulnerability affects Oracle Hyperion Data Relationship Management component Access and Security in version 11.2.25.0.000. An unauthenticated attacker with network access via HTTP could exploit this flaw to gain unauthorized access, including creation, deletion, or modification of critical data. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with high severity. Oracle’s August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly state patch availability for the affected version. Oracle recommends applying security patches promptly to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Data Relationship Management. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability requires network access via HTTP and is difficult to exploit.

Oracle strongly recommends applying the latest Critical Security Patch Updates without delay as they contain targeted security fixes. Although the advisory lists many patched products, it does not explicitly confirm a patch for version 11.2.25.0.000 of Oracle Hyperion Data Relationship Management. Therefore, users should monitor Oracle’s official security advisories and apply patches as soon as they become available. Until patched, restricting network access to the affected service and applying compensating controls may reduce exposure.