This vulnerability affects Oracle Hyperion Data Relationship Management component Access and security in version 11.2.25.0.000. It is exploitable remotely over HTTP without authentication but is considered difficult to exploit. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Data Relationship Management and potentially impact other Oracle products due to scope change. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts with no availability impact. Oracle has included this fix in their August 2026 Critical Security Patch Update.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Data Relationship Management. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond the initially targeted component. The confidentiality and integrity of data are highly impacted, but availability is not affected. This could lead to significant data compromise within affected Oracle environments.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond applying the official patch.