Oracle Hyperion Data Relationship Management product version 11.2.25.0.000 contains a flaw in its access and security component that allows an attacker without valid credentials, merely with network access to the HTTP interface, to read or alter critical data. The vulnerability is classified with a CVSS 3.1 base score of 8.2, indicating high confidentiality impact and moderate integrity impact. Successful exploitation would let the attacker retrieve or tamper with any data accessible through the affected system, potentially compromising business‑critical information. Affected systems include Oracle Corporation’s Oracle Hyperion Data Relationship Management 11.2.25.0.000 deployments. The product is commonly used for data modeling, reporting, and audit tasks in enterprise settings. No other targeted versions are listed, so only installations running the exact affected build are at risk. Risk assessment: the vulnerability is considered easily exploitable as it requires only unauthenticated HTTP traffic and no special privileges. The EPSS score is not available, but the CVSS score of 8.2 reflects a severe risk. The issue is not yet listed in CISA’s Known Exploited Vulnerabilities catalog, and the KEV status is “not listed.” The likely attack vector is an unauthenticated HTTP request to the Hyperion server, which the attacker can use to read or modify data if the security configuration is permissive or misconfigured.

Affected systems include Oracle Corporation’s Oracle Hyperion Data Relationship Management 11.2.25.0.000 deployments. The product is commonly used for data modeling, reporting, and audit tasks in enterprise settings. No other targeted versions are listed, so only installations running the exact affected build are at risk.

Risk assessment: the vulnerability is considered easily exploitable as it requires only unauthenticated HTTP traffic and no special privileges. The EPSS score is not available, but the CVSS score of 8.2 reflects a severe risk. The issue is not yet listed in CISA’s Known Exploited Vulnerabilities catalog, and the KEV status is “not listed.” The likely attack vector is an unauthenticated HTTP request to the Hyperion server, which the attacker can use to read or modify data if the security configuration is permissive or misconfigured.