Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:44.117Z",
  "pubdate": "2026-08-18T21:17:44.117Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. This security flaw allows a low-privileged remote attacker with network access via HTTP to compromise the target application entirely.\nSuccessful exploitation of this vulnerability results in a complete takeover of Oracle Hyperion Data Relationship Management, yielding severe impacts on confidentiality, integrity, and availability. The baseline severity of this vulnerability is rated critically high with a CVSS 3.1 base score of 8.8, reflecting the potential for full system compromise.\nThe attack vector is network-based, requiring minimal attacker preconditions beyond low-level authentication and HTTP connectivity to the vulnerable endpoint. Given the breadth of impact across all security triads, organizations utilizing the affected version face significant operational and data integrity risks.",
  "technicalDetails": "The vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000, specifically impacting how authorization and session or privilege validation are enforced over HTTP network channels.\nExploitation requires a low-privileged authenticated attacker to interact with the web application via HTTP. Because the vulnerability is characterized as easily exploitable with low attack complexity and no required user interaction, the attacker can leverage standard network interfaces to transmit crafted requests.\nThe root cause stems from insufficient validation, flawed access controls, or improper handling of security boundaries within the affected component, allowing an authenticated user to escalate privileges or execute administrative functions unauthorized.\nDuring the attack flow, the adversary leverages their low-privileged session to send malicious HTTP payloads directly to the vulnerable Access and security component. Due to inadequate server-side enforcement, the application processes the request improperly, granting the attacker elevated privileges or unauthorized control capabilities.\nPost-exploitation impact culminates in a full takeover of Oracle Hyperion Data Relationship Management. The attacker achieves complete control over the application environment, allowing them to read, modify, or delete sensitive master data structures, compromise system configurations, and disrupt availability for legitimate users."
}