The vulnerability is in the Access and Security component of Oracle Hyperion Data Relationship Management. It allows an unauthenticated attacker who can reach the host’s physical network segment to bypass security controls. The flaw permits creation, deletion or modification of data, and grants read access to all data stored in the system. This results in a loss of confidentiality and integrity for all data handled by the application. The weakness aligns with improper access control and authentication. The CVSS 3.1 base score is 8.1.

Affected systems are Oracle Hyperion Data Relationship Management version 11.2.25.0.000, supplied by Oracle Corporation. No other product or version details are stated. The vulnerability is documented in Oracle’s security alert for August 2026.

Risk level is high based on the CVSS score of 8.1. Exploitation requires local network access, meaning an attacker must be on the same physical communication segment as the Hyperion host. The EPSS score is ≤ 1%, indicating a very low exploitation probability. The lack of a KEV entry suggests no confirmed exploitation yet. Nonetheless, the ability to modify or read critical data gives an attacker significant advantage, so the threat is serious for environments where the system lies on a network accessible to untrusted personnel or devices.