Oracle Hyperion Data Relationship Management version 11.2.25.0.000 contains a flaw in its Access and Security component that permits a high‑privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to full control over the application, affecting confidentiality, integrity, and availability of the data it manages.

The only affected variant is Oracle Hyperion Data Relationship Management 11.2.25.0.000 as identified by Oracle in its August 2026 security alert.

The vulnerability carries a CVSS 3.1 base score of 6.6, indicating medium severity. Its EPSS score is below 1 %, and it does not appear in CISA’s KEV catalog, implying that widespread exploitation is unlikely. The attack vector is network‑based (HTTP) and requires the attacker to possess high privileges, suggesting that an adversary would need to either already have authorized access or compromise an intermediate account before exploiting the flaw. The combination of moderate exploitation difficulty and the potential for full system takeover places this vulnerability in a moderate‑to‑high risk category for affected deployments.