Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T21:17:43.360Z",
  "pubdate": "2026-08-18T21:17:43.360Z",
  "executiveSummary": "A critical vulnerability affecting the Oracle Hyperion Data Relationship Management product allows unauthenticated remote attackers to achieve full system compromise.\nSpecifically impacting the Access and security component in version 11.2.25.0.000, the flaw exhibits a CVSS 3.1 base score of 9.8 with maximum impact vectors across confidentiality, integrity, and availability.\nThe vulnerability is classified as easily exploitable, requiring no user interaction or prior authentication.\nAttackers with network access via TCP can interact directly with the vulnerable service to execute unauthorized commands or access sensitive administrative controls.\nSuccessful exploitation results in the complete takeover of the Oracle Hyperion Data Relationship Management instance, posing severe risk implications to enterprise environments relying on the application for master data management.\nRemediation requires applying the official vendor-supplied patches or updates corresponding to the affected version.",
  "technicalDetails": "The vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000.\nThe root cause stems from improper input validation, authorization checks, or flawed session handling within the network-exposed services listening over TCP protocols.\nBecause the affected component lacks adequate authentication mechanisms and privilege verification routines for incoming network requests, an unauthenticated remote attacker can bypass security controls entirely.\nAttackers initiate exploitation by sending specially crafted TCP payloads directly to the vulnerable listening ports associated with the Oracle Hyperion Data Relationship Management application.\nThe attack flow proceeds as follows: First, the attacker establishes a network connection over TCP to the target endpoint hosting the vulnerable Access and security component without supplying any credentials.\nSecond, the attacker transmits a malicious payload designed to exploit the underlying flaw in request parsing or session establishment.\nThird, the application processes the unvalidated input, leading to memory corruption, insecure deserialization, or logic bypasses that grant administrative privileges to the attacker.\nOnce execution control or administrative access is achieved, the attacker achieves complete takeover of the Oracle Hyperion Data Relationship Management environment.\nThe post-exploitation impact includes full read, write, and execute capabilities over sensitive master data repositories, unauthorized modification of user access controls, and complete disruption of application availability."
}