This vulnerability affects Oracle Hyperion Data Relationship Management component 'Access and security' in version 11.2.25.0.000. It is exploitable remotely over the network via HTTPS by a low privileged attacker but requires user interaction from a third party. The vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Data Relationship Management and may affect other Oracle products due to scope change. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and high confidentiality and integrity impacts without availability impact. Oracle has addressed this vulnerability in their August 2026 Critical Security Patch Update advisory.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Data Relationship Management. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond the initially affected component. Confidentiality and integrity of data are highly impacted, but availability is not affected. This could result in significant unauthorized data manipulation and access within affected environments.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.