Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hyperion Data Relationship Management executes to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-18T21:17:46.993Z",
  "pubdate": "2026-08-18T21:17:46.993Z",
  "executiveSummary": "An easily exploitable security vulnerability has been identified within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. This flaw allows an unauthenticated threat actor who has obtained local logon access to the underlying infrastructure where the product executes to compromise the application. Successful exploitation of this vulnerability yields severe security implications regarding data assurance, specifically granting unauthorized creation, deletion, or modification access to critical data and all accessible application data, alongside unauthorized reading capabilities for the same critical and comprehensive data repositories. The associated CVSS 3.1 Base Score is 7.7, reflecting high impacts to both confidentiality and integrity with no direct availability impact. The attack vector is localized (AV:L), with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N), while maintaining an unchanged security scope (S:U). Organizations utilizing the affected version face significant risk if local host security controls are insufficient, as malicious entities could manipulate master data assets once infrastructural access is achieved.",
  "technicalDetails": "The vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The root cause stems from inadequate security controls and permission validation mechanisms governing sensitive data structures and operational execution paths within the local environment. Because the application relies on underlying infrastructural trust boundaries, an unauthenticated attacker who has successfully established a local logon session to the host operating system can leverage this weakness to bypass intended security constraints.\nThe exploitation method relies heavily on local infrastructure access (AV:L) with low complexity (AC:L). Because no privileges (PR:N) or user interaction (UI:N) are required, an attacker with baseline execution capabilities on the host can interact directly with vulnerable internal interfaces, binaries, or data stores associated with the Access and security component. The attack flow initiates when the adversary leverages their local foothold on the infrastructure hosting Oracle Hyperion Data Relationship Management. By exploiting the insecure handling of access controls within the targeted component, the attacker bypasses authentication boundaries and gains unauthorized privileges to manipulate or inspect the application state.\nThe post-exploitation impact is severe, encompassing high-level breaches of confidentiality and integrity (C:H/I:H/A:N). Once the attack payload or procedural exploitation steps are executed locally, the threat actor achieves unauthorized data manipulation capabilities, allowing them to create, modify, or delete critical and accessible master data records within Oracle Hyperion Data Relationship Management. Simultaneously, the attacker obtains complete unauthorized visibility into sensitive data repositories managed by the application, leading to severe data leakage and compromised data integrity without directly impacting system availability (S:U)."
}