Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hyperion Data Relationship Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-18T21:17:48.050Z",
  "pubdate": "2026-08-18T21:17:48.050Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. This security flaw enables a remote, low-privileged attacker with network access via HTTPS to compromise the affected system, provided that the attack involves human interaction from an individual other than the attacker. Due to a scope change, successful exploitation can extend beyond Oracle Hyperion Data Relationship Management to significantly impact additional products. The risk implications are severe, as successful attacks can result in unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle Hyperion Data Relationship Management, alongside unauthorized or complete access to critical and accessible data sets. The assigned CVSS 3.1 Base Score is 8.7, reflecting high impacts to confidentiality and integrity with no availability impact.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. Exploitation of this security issue requires network access via the HTTPS protocol, leveraging the application's attack surface exposed over standard web communication channels. The threat actor must possess low privileges within the system to initiate the attack sequence. Additionally, a crucial prerequisite for successful exploitation is human interaction, necessitating that a user other than the attacker performs a specific action to facilitate the compromise.\nThe attack flow begins when a low-privileged attacker leverages network connectivity over HTTPS to target the vulnerable Access and security component. Because the attack relies on human interaction, the attacker typically induces a victim, such as a higher-privileged user or administrator, to interact with a crafted payload or malicious link processed by the Oracle Hyperion Data Relationship Management application. Upon execution and successful user interaction, the security controls governing the component are bypassed or improperly enforced, leading to a scope change (S:C). This scope change signifies that the impact extends beyond the immediate administrative boundaries of Oracle Hyperion Data Relationship Management to compromise additional collateral products integrated within the environment.\nPost-exploitation impacts are critical to system integrity and data confidentiality. The attacker gains unauthorized data access capabilities, allowing them to read critical or all accessible data within Oracle Hyperion Data Relationship Management. Furthermore, the vulnerability permits unauthorized creation, deletion, and modification access, enabling the attacker to manipulate critical data sets or alter the entire repository of accessible application data. The combination of low required privileges, network exposure, and cross-product scope changes underscores the severe security risks associated with this vulnerability in enterprise architectures."
}