Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:43.740Z",
  "pubdate": "2026-08-18T21:17:43.740Z",
  "executiveSummary": "A security vulnerability has been identified within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. This vulnerability represents a severe risk to enterprise master data management environments, classified with a CVSS 3.1 Base Score of 8.8, indicating high severity across confidentiality, integrity, and availability impact metrics. The flaw is easily exploitable by a low-privileged threat actor who possesses network access via the HTTP protocol.\nSuccessful exploitation of this vulnerability grants the attacker the ability to achieve a complete system takeover of Oracle Hyperion Data Relationship Management. This compromises the entire master data repository, potentially allowing unauthorized data manipulation, exfiltration, or complete disruption of business-critical hierarchy management processes. The attack vector is strictly network-based with low attack complexity, requiring no user interaction, though the attacker must possess authenticated low-privileged access to the target system.\nOrganizations utilizing the affected Oracle Hyperion Data Relationship Management version must prioritize remediation by applying official vendor patches as supplied by Oracle, restricting network exposure, and enforcing strict access controls to limit potential exploitation vectors.",
  "technicalDetails": "The vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The architecture of the application exposes administrative or privileged functionality over the HTTP protocol, which fails to adequately validate or restrict operations performed by users possessing low privileges. This authorization or access control flaw allows an authenticated adversary to bypass intended security boundaries and execute unauthorized administrative actions.\nThe attack flow begins when an attacker authenticates to the Oracle Hyperion Data Relationship Management application using low-privileged credentials. Leveraging network access via HTTP, the attacker crafts malicious requests targeting the vulnerable Access and security component. Because the underlying logic insufficiently verifies whether the requesting principal holds the requisite administrative role or authorization level, the application processes the malformed or unauthorized requests.\nUpon successful processing of the payload, the attacker can elevate privileges, modify critical security configurations, or execute arbitrary administrative commands within the context of the application. This post-exploitation state results in a full system takeover, granting the adversary complete control over the Oracle Hyperion Data Relationship Management instance, including underlying databases, master data hierarchies, and integrated enterprise metadata repositories."
}