Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:17:44.850Z",
  "pubdate": "2026-08-18T21:17:44.850Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Access and security component of the Oracle Hyperion Data Relationship Management product, specifically affecting version 11.2.25.0.000. This vulnerability permits unauthenticated threat actors leveraging network access via the HTTP protocol to compromise the affected system completely. Successful exploitation of this flaw yields unauthorized read, write, creation, and deletion capabilities against critical data and all accessible information within Oracle Hyperion Data Relationship Management.\nThe risk implications are severe due to the direct impact on data confidentiality and integrity, rated with a CVSS 3.1 Base Score of 9.1. The attack vector is strictly network-based with low attack complexity, requiring no user interaction or prior authentication privileges. Consequently, remote adversaries can interact directly with the vulnerable HTTP service to execute unauthorized data operations, compromising enterprise master data management security domains.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The root cause stems from improper authorization enforcement and inadequate access control validation within HTTP request handlers exposed by the application layer. Because the endpoint fails to properly authenticate and authorize incoming requests before processing them, an unauthenticated remote attacker can bypass security boundaries.\nThe attack flow begins when an adversary, positioned with network access to the target host, transmits a crafted HTTP request directly to the vulnerable Access and security component. Due to the absence of authentication (PR:N) and the low complexity (AC:L) of the flaw, the application processes the request without verifying the identity or privileges of the sender. The network exposure vector (AV:N) allows this interaction to occur remotely without requiring physical access or prior compromise of local system accounts.\nUpon successful processing of the malicious payload, the application executes unauthorized operations on behalf of the unauthenticated entity. This results in post-exploitation impacts characterized by the complete compromise of data integrity and confidentiality (C:H, I:H), while availability remains unaffected (A:N). Attackers can systematically harvest critical proprietary master data, inject unauthorized metadata modifications, or purge records entirely from the Oracle Hyperion Data Relationship Management repository, leading to severe operational disruption and data corruption."
}