Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Data Relationship Management executes to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:48.167Z",
  "pubdate": "2026-08-18T21:17:48.167Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Access and security component of the Oracle Hyperion Data Relationship Management product, specifically affecting version 11.2.25.0.000. This security flaw enables an unauthenticated attacker to compromise the integrity and confidentiality of the targeted system. The risk implications are severe, as successful exploitation grants unauthorized threat actors the capability to execute unauthorized creation, deletion, or modification of critical data, alongside complete unauthorized read access to all accessible data within Oracle Hyperion Data Relationship Management.\nExploitation of this vulnerability requires the attacker to have physical or logical access to the physical communication segment attached to the underlying hardware where the Oracle Hyperion Data Relationship Management instance is executing. Because the attack vector relies on adjacent network positioning, the attacker does not require prior authentication or user interaction to successfully compromise the system. The high CVSS 3.1 base score of 8.1 underscores the critical nature of the confidentiality and integrity impacts, making prompt defensive intervention essential for organizations running the affected version.",
  "technicalDetails": "The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The root cause stems from insufficient security controls and validation mechanisms within the communication pathways of the affected component, allowing unauthorized entities positioned on the local physical communication segment to interact with internal application interfaces.\nThe attack vector is classified as adjacent network (AV:A), meaning the attacker must be situated on the same physical or logical communication segment as the target hardware hosting the Oracle Hyperion Data Relationship Management deployment. The complexity of the attack is low (AC:L), and it requires zero privileges (PR:N) as well as no user interaction (UI:N). The scope remains unchanged (S:U).\nThe step-by-step attack flow begins with the unauthenticated threat actor establishing presence on the attached physical communication segment. From this vantage point, the attacker transmits crafted payloads or unauthorized command sequences directly toward the vulnerable Oracle Hyperion Data Relationship Management interface. Because the Access and security component fails to adequately authenticate or authorize traffic originating from the local communication segment, the application accepts the malicious payloads.\nUpon successful processing of the payload, the post-exploitation impact allows the attacker to bypass standard security boundaries. The adversary gains unauthorized data manipulation capabilities, resulting in the creation, modification, or deletion of critical application data. Additionally, the attacker achieves unauthorized access to sensitive information, compromising the confidentiality and integrity of all data accessible to Oracle Hyperion Data Relationship Management, while availability remains unimpacted (A:N)."
}