Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-18T21:17:45.450Z",
  "pubdate": "2026-08-18T21:17:45.450Z",
  "executiveSummary": "A vulnerability exists within the Access and security component of the Oracle Hyperion Data Relationship Management product, specifically affecting version 11.2.25.0.000. This security flaw is classified as a difficult to exploit vulnerability that can be leveraged by a highly privileged malicious actor with network access via the HTTP protocol. Successful exploitation of this vulnerability grants the attacker the capability to achieve complete system takeover of the affected Oracle Hyperion Data Relationship Management application, resulting in a severe compromise of confidentiality, integrity, and availability. The Common Vulnerability Scoring System version 3.1 assigns a base score of 6.6 with a vector of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The high attack complexity and strict requirement for high-level administrative privileges mitigate the ease of exploitation, yet the potential impact remains critical due to the risk of full application takeover. Organizations utilizing the specified version must evaluate exposure and apply defensive measures in alignment with official vendor guidance.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The flaw allows an authenticated attacker possessing high-level privileges to interact with vulnerable functions exposed over the network via the HTTP protocol. Although the attack complexity is rated as high, indicating that specific preconditions or intricate exploitation steps are required to achieve success, a successful exploit bypasses existing authorization boundaries within the security architecture.\nThe attack flow begins when an attacker with administrative or high-privileged credentials crafts a specialized request directed at the vulnerable HTTP endpoints managed by the Access and security component. Because the component fails to properly validate or handle specific privileged inputs or state transitions, the malicious payload manipulates internal application logic or underlying system controls. This manipulation circumvents intended access restrictions, leading to an elevation of privilege or unauthorized execution of administrative functions.\nUpon successful exploitation, the attacker achieves full control over the Oracle Hyperion Data Relationship Management environment. This post-exploitation state, referred to as system takeover, grants the adversary unfettered access to sensitive master data hierarchies, organizational metadata, and administrative configurations. The impact spans all three pillars of information security: confidentiality is breached via unauthorized data exfiltration, integrity is compromised through malicious modification or destruction of master data structures, and availability is threatened by the potential disruption or halting of core application services."
}