Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-18T21:17:47.700Z",
  "pubdate": "2026-08-18T21:17:47.700Z",
  "executiveSummary": "A vulnerability exists within the Access and security component of the Oracle Hyperion Data Relationship Management product, specifically affecting version 11.2.25.0.000. This security flaw is categorized as a remote, difficult-to-exploit vulnerability that can be leveraged by an unauthenticated attacker via HTTP network access. Successful exploitation of this vulnerability has a scope-changing impact, meaning that attacks can significantly compromise additional products beyond the primary vulnerable application. The potential consequences of a successful exploit include unauthorized creation, deletion, or modification of critical data, as well as complete unauthorized access to all accessible data within Oracle Hyperion Data Relationship Management. The severity of this vulnerability is underscored by a CVSS 3.1 Base Score of 8.7, reflecting high impacts to both confidentiality and integrity while leaving availability unaffected. Exploitation does not require user interaction or pre-existing privileges, though it does involve high attack complexity.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The root cause allows an unauthenticated remote entity to interact with insecurely handled security and access controls over the HTTP protocol. Because the attack vector is network-based (AV:N), adversaries do not require local access or prior authentication (PR:N) and no user interaction is necessary (UI:N) to initiate the exploitation sequence. Although the attack complexity is rated as high (AC:H), indicating that successful exploitation requires specific conditions or precise timing by the attacker, the resultant impact is severe due to a security scope change (S:C).\nThe attack flow proceeds via the network layer where an unauthorized actor transmits crafted HTTP requests targeting the vulnerable Access and security functions. Due to insufficient validation, authorization enforcement, or access control boundary validation within the affected component, the malicious payload bypasses intended security mechanisms. Because of the scope-changing nature of the flaw, the compromise is not strictly contained within Oracle Hyperion Data Relationship Management; rather, it extends trust boundaries to affect additional interconnected or dependent products within the enterprise environment.\nPost-exploitation impacts include comprehensive breaches of data confidentiality and integrity (C:H/I:H/A:N). An attacker who successfully navigates the high complexity requirements can execute unauthorized data manipulation operations, including the creation, deletion, and modification of critical or all accessible data within the system. Furthermore, the attacker gains unauthorized read access to critical application data and complete access to all data repositories accessible by Oracle Hyperion Data Relationship Management, leading to severe enterprise data exposure and integrity degradation."
}