Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:47.587Z",
  "pubdate": "2026-08-18T21:17:47.587Z",
  "executiveSummary": "A security vulnerability has been identified within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. This vulnerability represents a severe security flaw that can be leveraged by a remote attacker to achieve complete system takeover. The issue is classified as easily exploitable, requiring minimal attacker capabilities.\nThe flaw allows a low-privileged authenticated attacker with network access via the HTTP protocol to compromise the affected application. Successful exploitation of this vulnerability yields severe impacts across all three pillars of the CIA triad, resulting in complete loss of confidentiality, integrity, and availability of the Oracle Hyperion Data Relationship Management product.\nGiven the potential for a full system takeover and the high CVSS 3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), organizations running the affected version face significant risk. The vulnerability requires low privileges and network connectivity, making internal or compromised low-level accounts an immediate threat vector. Immediate remediation and access control enforcement are critical to mitigate the risk of unauthorized administrative escalation and asset compromise.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management, specifically affecting version 11.2.25.0.000. The underlying architectural flaw enables unauthorized privilege escalation or improper access control enforcement within the application's security boundary.\nExploitation of this vulnerability occurs remotely over the network using the HTTP protocol. An attacker must possess low privileges within the application to initiate the attack sequence, but no user interaction is required. The low attack complexity indicates that the flaw is consistently reproducible and does not rely on complex race conditions or probabilistic memory corruption states.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes network connectivity to the vulnerable Oracle Hyperion Data Relationship Management HTTP interface. Second, the attacker crafts a malicious request leveraging the weaknesses within the Access and security component, bypassing intended authorization checks. Third, the application processes the input without properly validating the boundaries of the authenticated user's operational privileges. Finally, the malicious payload achieves execution context elevation, granting the attacker administrative control over the application.\nPost-exploitation impact includes a complete system takeover. Because the vulnerability compromises confidentiality, integrity, and availability, an attacker who successfully executes this attack can read sensitive master data, modify hierarchical relationships and security configurations, disrupt operational availability, and potentially pivot to underlying operating system resources depending on service account permissions. The lack of robust input validation and authorization enforcement within the Access and security subsystem forms the root cause of this takeover vector."
}