Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:17:43.993Z",
  "pubdate": "2026-08-18T21:17:43.993Z",
  "executiveSummary": "An easily exploitable security vulnerability has been identified within the Oracle Hyperion Data Relationship Management product, specifically affecting the Access and security component in version 11.2.25.0.000. This vulnerability allows an authenticated attacker with high privileges and network access via HTTPS to fully compromise the target system.\nThe inherent risks associated with this flaw are severe, demonstrated by a CVSS 3.1 Base Score of 9.1 with a vector of (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The scope of the vulnerability is changed (S:C), indicating that successful exploitation can extend beyond the immediate Oracle Hyperion Data Relationship Management product to significantly impact additional integrated or collateral systems.\nAttacker capabilities require high privileges (PR:H) and network vector connectivity (AV:N) with low attack complexity (AC:L), requiring no user interaction (UI:N). Successful exploitation achieves complete system takeover, resulting in total loss of confidentiality, integrity, and availability (C:H/I:H/A:H) across the affected and impacted components.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The root cause stems from insufficient validation, authorization, or secure handling within the administrative security architecture, allowing a highly privileged user to abuse exposed interfaces or logic flaws via the HTTPS protocol.\nExploitation requires the attacker to possess pre-established high-level administrative or privileged credentials within the application. Communication and payload delivery occur over the network via HTTPS, bypassing internal security boundaries due to inadequate authorization checks or flawed access control enforcement within the Access and security subsystem.\nThe attack flow proceeds as follows: First, the authenticated attacker with high privileges establishes a secure network connection via HTTPS to the target Oracle Hyperion Data Relationship Management instance. Second, the attacker interacts with the vulnerable Access and security component, submitting maliciously crafted requests or inputs designed to exploit the underlying architectural weakness. Third, due to the lack of stringent validation and boundary enforcement, the component processes the request, leading to privilege escalation or unauthorized execution of administrative functions. Finally, the attacker achieves complete system takeover of Oracle Hyperion Data Relationship Management.\nBecause the vulnerability exhibits a scope change (S:C), the impact of the exploitation is not strictly localized to the primary application container or process space. Post-exploitation impact includes the potential unauthorized access, modification, or destruction of interconnected ecosystem data, cascading failures to additional products, and complete compromise of confidentiality, integrity, and availability across the broader infrastructure."
}