Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Data Relationship Management executes to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:47.933Z",
  "pubdate": "2026-08-18T21:17:47.933Z",
  "executiveSummary": "An access and security vulnerability affects the Oracle Hyperion Data Relationship Management product of Oracle Hyperion, specifically version 11.2.25.0.000.\nThe vulnerability is easily exploitable and allows a low-privileged attacker with logon access to the underlying infrastructure where the application executes to compromise the system.\nSuccessful exploitation of this security flaw can lead to unauthorized creation, deletion, or modification access to critical data or all accessible application data, alongside unauthorized access to critical data or complete access to all accessible application data.\nThe CVSS 3.1 Base Score is 7.1 with significant confidentiality and integrity impacts, designated by the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.\nRisk implications include severe data compromise and unauthorized manipulation of core business metadata stored within the Oracle Hyperion Data Relationship Management environment.\nExploitation requires local access to the host infrastructure and low-privileged authentication, but does not require user interaction.",
  "technicalDetails": "The vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000.\nThe attack vector is classified as Local (AV:L), meaning the adversary must already possess interactive or programmatic logon access to the host infrastructure hosting the targeted application execution environment.\nThe attack complexity is low (AC:L), indicating that the conditions required to successfully exploit the vulnerability are straightforward and do not demand specialized circumvention techniques.\nPrivilege requirements are set to low (PR:L), signifying that the attacker must authenticate with standard, non-administrative user credentials on the local infrastructure.\nUser interaction is not required (UI:N), allowing the attack to proceed deterministically without manual intervention from other system users or administrators.\nThe scope is unchanged (S:U), as the security impact is contained within the boundaries of the vulnerable Oracle Hyperion Data Relationship Management component and its direct data assets.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes a session or executes code on the underlying infrastructure hosting Oracle Hyperion Data Relationship Management. Second, leveraging inadequate access controls within the Access and security component, the attacker bypasses intended authorization boundaries. Third, the attacker interacts directly with vulnerable internal mechanisms or data stores. Finally, the attacker achieves unauthorized read, write, creation, or deletion capabilities over critical or all accessible Oracle Hyperion Data Relationship Management data.\nPost-exploitation impact includes severe confidentiality breaches via unauthorized access to critical data sets and catastrophic integrity failures through unauthorized creation, modification, or deletion of core application data."
}