This vulnerability in Oracle Hyperion Data Relationship Management (component: Access and security) affects version 11.2.25.0.000. An unauthenticated attacker with physical network access to the communication segment attached to the hardware running the product can exploit this flaw to gain unauthorized creation, deletion, or modification rights over critical or all accessible data within the product. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among 943 patches, urging customers to apply patches promptly to mitigate exploitation risks.

The vulnerability allows unauthorized attackers with physical network access to compromise Oracle Hyperion Data Relationship Management, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. This impacts confidentiality and integrity of data but does not affect availability. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the relevant security patches without delay. No additional mitigation steps are specified beyond patching. Since this is not a cloud service, remediation depends on customer patch application. Patch status is confirmed by the vendor advisory.