Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:17:44.963Z",
  "pubdate": "2026-08-18T21:17:44.963Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. This security flaw permits unauthenticated threat actors with network access via the SOAP protocol to compromise the affected application remotely.\nSuccessful exploitation of this vulnerability has severe security implications, granting unauthorized attackers the capability to execute unauthorized creation, deletion, and modification of critical data, alongside complete unauthorized access to all accessible Oracle Hyperion Data Relationship Management data assets.\nThe vulnerability exhibits a CVSS 3.1 Base Score of 9.1, driven by high impacts to both confidentiality and integrity without affecting system availability. The associated CVSS vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nBecause the vulnerability requires no privileges, no user interaction, and presents a low attack complexity over a network vector, organizations utilizing the specified supported version face substantial risk of data compromise and unauthorized manipulation of master data management repositories. Remediation requires applying vendor-supplied updates or restricting network exposure to trusted administrative segments.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000, specifically within the SOAP interface handling authentication, authorization, or administrative request processing.\nThe root cause stems from improper enforcement of access controls within the SOAP endpoint handlers, allowing unauthenticated network requests to bypass security validation checks and interact directly with sensitive data management functions.\nAttackers exploit this vulnerability remotely over the network by transmitting crafted SOAP messages directly to the exposed service endpoints of Oracle Hyperion Data Relationship Management. Because the attack vector is network-based (AV:N), exploitation requires no prior access to the internal network infrastructure beyond routing capabilities to the target service.\nThe attack flow proceeds as follows: First, the unauthenticated adversary identifies the network-accessible SOAP service associated with the Oracle Hyperion Data Relationship Management application. Second, the attacker formulates an arbitrary API request payload designed to interact with backend data relationship structures, omitting any valid authentication tokens or credentials. Third, due to the flawed security controls in the Access and security component, the application processes the request as a legitimate transaction. Finally, the attacker achieves unauthorized read, write, modification, or deletion capabilities over critical data repositories.\nThe privilege requirement is entirely absent (PR:N), meaning anonymous or unauthenticated entities can execute arbitrary transaction commands. Furthermore, the attack requires zero user interaction (UI:N) and features low attack complexity (AC:L), enabling automated exploitation tools to target the flaw at scale.\nThe post-exploitation impact spans both the confidentiality and integrity security triad pillars (C:H/I:H/A:N). An adversary can harvest proprietary master data, organizational hierarchies, and sensitive financial or operational datasets, while simultaneously corrupting, destroying, or forging data records within the Oracle Hyperion Data Relationship Management system, leading to severe data integrity failures."
}