This vulnerability affects Oracle Hyperion Data Relationship Management 11.2.25.0.000 and involves the Access and Security component. An attacker with low privileges and logon access to the infrastructure can exploit this flaw to gain unauthorized access and control over critical data within the system. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle has published this vulnerability as part of their August 2026 Critical Security Patch Update. The vendor advisory strongly recommends applying security patches promptly to mitigate such vulnerabilities.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Hyperion Data Relationship Management. This compromises the confidentiality and integrity of the data but does not affect availability. The attacker requires only low privileges and local access to the infrastructure, making the vulnerability easily exploitable in environments where an attacker has such access.

Oracle has included this vulnerability in their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches without delay to remediate this vulnerability. Staying on actively supported versions and promptly applying Oracle's security patches is the recommended mitigation. No alternative or temporary mitigations are specified in the advisory.