The vulnerability is located in the access and security component of Oracle Hyperion Data Relationship Management. The official advisory states that an unauthenticated attacker with network access via TCP can exploit the flaw and compromise the system. While the description does not explicitly call it an authentication bypass, the fact that no credentials are required allows us to infer that it effectively bypasses authentication controls. Successful exploitation results in full takeover, giving the attacker total control over the application and its data. The flaw is classified as CWE-284 and carries a CVSS v3.1 base score of 9.8, indicating high confidentiality, integrity, and availability impact.

Oracle Hyperion Data Relationship Management version 11.2.25.0.000 from Oracle Corporation is the affected product. This specific release was identified by the CNA as vulnerable; no other versions or products are listed in the advisory.

The vulnerability is remotely exploitable without any prior authentication or privilege; an attacker only needs network reachability to the TCP port hosting the service. The EPSS score of <1% suggests a currently low exploitation probability, but the CVSS score of 9.8 highlights a severe potential impact should the vulnerability be exploited. Despite not being listed in the CISA KEV catalog, the ability of an attacker to gain unrestricted control over the application warrants urgent attention. Zero‑auth requirements and network exposure create a highly dangerous attack surface.