Hyperion Data Relationship Management
Monthly
Unauthenticated denial of service in Oracle Hyperion Data Relationship Management 11.2.26.0.000 lets any attacker who can reach the HTTP interface hang or repeatedly crash the application, removing master-data services for all legitimate users. Oracle rates it CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only), and the vulnerable code sits in the 'Access and security' component, so no credentials or user interaction are needed. Active exploitation is not confirmed — no KEV listing, EPSS score, or public exploit code was supplied with this report — but the low attack complexity makes automated mass scanning plausible if the endpoint is internet-reachable.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access-and-security flaw that lets a high-privileged attacker reach the application over HTTP and create, delete or modify critical master-data records while also reading data they should not be able to reach. The CVSS 3.1 score is 7.7 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-trigger but high-impact condition that also escapes the product boundary and can affect other Oracle products. No public exploit code or CISA KEV entry was identified, and exploitation requires an already high-privileged account, so this is a privileged-insider or post-compromise escalation and data-integrity risk rather than a mass-exploited remote flaw.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 exposes an access-and-security weakness that lets a low-privileged, authenticated user reach data they should not see and alter records they should not touch. The flaw is reachable over the network through ordinary HTTP requests with no user interaction, and Oracle rates it 7.1 with high confidentiality impact and partial integrity impact. Exploitation grants read access to critical master-data content and limited unauthorized insert, update, or delete capability; no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 is vulnerable to an unauthenticated, network-reachable flaw in its Access and Security component that lets an attacker read sensitive data, modify or delete records, and partially disrupt service availability via crafted HTTP requests. The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable remote access with no credentials or user interaction, though the confidentiality, integrity and availability impacts are each rated Low rather than total compromise. No public exploit code or CISA KEV listing was present in the provided intelligence at time of analysis, so exploitation status is best characterized as no public exploit identified at time of analysis.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access-control flaw in its Access and security component, tagged as an authentication bypass. A low-privileged authenticated attacker with network access to the HTTP interface can, by inducing a separate user to interact with crafted content, cross a trust boundary and obtain unauthorized access to critical data or complete access to all accessible data, plus limited update/insert/delete privileges. Exploitation requires a valid low-privilege account (PR:L) and human interaction (UI:R), and no public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 base score is 7.6.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.26.0.000 contains a hard-to-exploit flaw in the product's Access and Security component that lets an unauthenticated attacker reachable over TCP create, delete or modify critical master data and read the full contents of the application. CVSS 3.1 scores it 7.4 with Confidentiality and Integrity both High, but only because no public exploit code and no CISA KEV entry exist does this remain an integrity-focused patching priority rather than an emergency. There is no public exploit identified at time of analysis and no EPSS score was supplied.
Unauthorized creation, deletion, and modification of critical master data plus partial denial of service in Oracle Hyperion Data Relationship Management 11.2.26.0.000 can be triggered by an unauthenticated attacker with network access over HTTPS, provided a victim other than the attacker is persuaded to interact with attacker-supplied content. The flaw sits in the Access and Security component, scores 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L), and carries no confidentiality impact - the damage is data integrity and reduced availability. There is confirmed actively exploited (CISA KEV)? No - no public exploit identified at time of analysis, and no EPSS or KEV data was supplied; Oracle has published a Critical Security Patch Update advisory covering supported versions.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 allows an authenticated low-privileged attacker with network HTTP access to bypass access controls in the 'Access and security' component and read critical data, up to and including everything the affected DRM instance can reach, with no user interaction required. The impact is confidentiality-only (CVSS 3.1 7.7, C:H/I:N/A:N) but carries a scope change (S:C), meaning the data exposed can extend beyond DRM into additional integrated Oracle products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the low-privileged account prerequisite keeps this a genuine but moderate-priority risk for organizations running the affected release in enterprise master-data deployments.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and Security component that allows a low-privileged, authenticated user with HTTP network access to escalate privileges and take over the application, with high impact to confidentiality, integrity and availability. The vulnerability is rated 'difficult to exploit' by Oracle (AC:H), so successful abuse requires favorable conditions rather than a single trivial request, but the payoff is full compromise of the DRM instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle has published a fix in its Critical Patch Update advisory.
Privilege escalation and full application takeover in Oracle Hyperion Data Relationship Management 11.2.26.0.000, where a low-privileged attacker with network access over HTTP can compromise the Access and Security component, resulting in complete loss of confidentiality, integrity, and availability of the product (CVSS 3.1 base 7.5). Exploitation is assessed as difficult (AC:H), consistent with a security-logic or state/timing-dependent flaw rather than a simple injection, and no public exploit code or CISA KEV entry was identified at time of analysis. The practical risk concentrates in large finance and EPM environments where DRM holds authoritative master-data hierarchies and is reachable by ordinary business users.
Unauthenticated denial of service in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 lets any attacker who can reach the product's SOAP interface send crafted requests that hang or repeatedly crash the service, wiping out availability of the master-data hub. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) in the Access and Security component, with no confidentiality or integrity impact. No public exploit code and no CISA KEV listing were present in the supplied intelligence, so exploitation status is unknown; the flaw is trivially automatable once patch details are reverse-engineered.
A low-privileged, authenticated attacker with HTTP access to Oracle Hyperion Data Relationship Management 11.2.26.0.000 can abuse the Access and security component to gain unauthorized read of critical data and make unauthorized updates or deletions, provided a separate user is induced to interact with attacker-supplied content. The CVSS 3.1 score of 7.6 includes a scope change, meaning a successful attack can significantly impact other Oracle Hyperion components that consume DRM data. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no CWE, CPE, EPSS, or KEV data was supplied with this report.
Unauthenticated attackers who can reach the Oracle Hyperion Data Relationship Management web interface over HTTP can bypass the product's access and security controls in version 11.2.26.0.000 and read any data the application itself can reach, giving complete confidentiality loss for that deployment with no integrity or availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the vulnerability is tagged as an authentication bypass, meaning exploitation requires no credentials, no user interaction and no special complexity. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied in the source data, so the immediate driver is the trivial unauthenticated network exposure rather than confirmed active exploitation.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains an access-control weakness in its Access and Security component that lets a network-positioned attacker holding only a low-privileged account read or fully extract critical master-data records and make limited unauthorized updates to them. Oracle's own CVSS 3.1 rating is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting complete compromise of confidentiality within the application scope but only partial integrity impact, with no availability effect. No public exploit code, EPSS score, or CISA KEV listing was supplied with the available intelligence, so active exploitation is unconfirmed; the only authoritative source is Oracle's security alert at https://www.oracle.com/security-alerts/cspusep2026.html.
Insufficient access controls in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 let a low-privileged, network-positioned user read data far beyond their granted role, including all data the DRM service can access. The flaw sits in the 'Access and security' component and carries a scope change, meaning compromised instances can become a pivot into additional Oracle Hyperion/EPM products that trust the DRM service. Oracle's CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no CISA KEV listing, public exploit code, or EPSS score was present in the supplied intelligence, so exploitation appears neither confirmed nor publicly demonstrated at time of analysis.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 lets a high-privileged, network-positioned user defeat the Access and security component and reach well beyond their intended authorization boundary - reading critical master data and gaining update/insert/delete capability over data they should not control. Exploitation is low-complexity (AC:L) and requires no user interaction (UI:N), but it is gated behind a pre-existing high-privilege account on the DRM instance (PR:H), and because the vector carries a scope change (S:C), success can cascade into connected EPM and finance systems that trust DRM as a source of record. No public exploit code or confirmed active exploitation has been identified at time of analysis, and with an EPSS-style signal absent the 7.6 High rating rests almost entirely on the CVSS vector rather than on observed threat activity.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an easily exploitable flaw in its Access and Security component that lets a low-privileged, network-positioned attacker compromise the application via HTTP. Successful exploitation requires a victim user to interact with attacker-supplied content, but yields high confidentiality impact (unauthorized read of critical DRM data) plus limited integrity impact, and the scope change means other Oracle Hyperion components or integrated products may also be affected. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so active exploitation is unconfirmed; severity is driven by the CVSS 3.1 base score of 7.6.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 exposes critical master-data through a flaw in its Access and Security component that lets a low-privileged, network-connected attacker read and partially modify data after inducing another user to interact. The CVSS 3.1 vector (7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) indicates the compromise can spill into other connected Hyperion products because of the scope change, with confidentiality impact rated high. No public exploit code or CISA KEV entry is present in the supplied intelligence, so this is currently a patch-now compliance issue rather than a confirmed active-exploitation emergency.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an authentication bypass in the Access and Security component that can be reached over the network through SMTP, allowing an unauthenticated attacker to create, delete, or modify critical data and to read the entirety of the application's accessible data. Oracle's security alert rates it 7.4 with high confidentiality and integrity impact but high attack complexity, indicating the exploit path is non-trivial even though no credentials or user interaction are required. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor-published advisory and the absence of any availability impact make this a targeted-tampering risk for finance and master-data teams rather than a broad worm-style threat.
Authentication bypass in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 lets an unauthenticated remote attacker with HTTP access to the DRM web tier read and modify the application's master data without supplying valid credentials. The flaw sits in the 'Access and security' component and carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no privileges, no user interaction, and low attack complexity are required; availability is explicitly not impacted (A:N). No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), but CISA's SSVC assessment rates it automatable with total technical impact, and EUVD tracks it as EUVD-2026-79784 - making it a high-priority item for any organization exposing DRM beyond a trusted internal network.
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Data Relationship Management version 11.2.26.0.000 (component: Access and security) to create, delete, or modify critical data and fully access all data accessible through the product via HTTP. This high-severity flaw (CVSS 9.1, CWE-287) requires no authentication, no user interaction, and low attack complexity, though practical exposure is limited to deployments where the DRM web interface is network-reachable. No public exploit code has been identified at time of analysis and it is not confirmed as actively exploited (CISA KEV); the SSVC assessment rates exploitation as none, automatable as yes, and technical impact as total.
Unauthenticated adjacent-network exploitation of Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables complete read and write access to all master data managed by the platform. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, allowing an attacker positioned on the same physical communication segment to exfiltrate sensitive hierarchical reference data and silently manipulate or delete critical records without credentials or user interaction. No public exploit has been identified at time of analysis and no CISA KEV listing has been observed, but the low attack complexity and absence of any authentication requirement make this a meaningful priority for organizations co-locating DRM with other internal systems on shared network segments.
Oracle Hyperion Data Relationship Management (DRM) 11.2.25.0.000 exposes a high-severity access control flaw that allows a low-privileged, network-authenticated attacker to fully compromise confidentiality and integrity of critical DRM data, with scope change extending impact to additional Oracle Hyperion products. Exploitation requires human interaction from a victim user, consistent with a cross-site or cross-context attack pattern (the 'Authentication Bypass' tag suggests privilege escalation beyond the attacker's initial access tier). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and integrity compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a local attacker holding low-privilege infrastructure credentials to fully circumvent application-level access controls, yielding complete read and write access to all DRM-managed master data. The vulnerability resides in the Access and security component and is tagged as an Authentication Bypass, suggesting internal authorization enforcement fails once basic OS-level access to the host is obtained. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical master data to unauthenticated remote attackers over HTTP. Exploitation requires human interaction from a victim user - consistent with a reflected or client-side attack vector - allowing an attacker to read or tamper with all data accessible within the DRM platform, including sensitive master data governance records. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this issue.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes the Access and Security component to unauthenticated remote attackers over HTTP, enabling full read and write access to critical master data hierarchies. The CVSS 3.1 score of 8.7 reflects a scope change (S:C), meaning successful exploitation can cascade to additional Oracle Hyperion EPM products beyond the initial target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirement and cross-component impact warrants prompt remediation.
Full system takeover in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated network attackers via HTTP, targeting the Access and Security component. Oracle's own advisory characterizes this as 'easily exploitable,' with successful exploitation resulting in complete compromise across confidentiality, integrity, and availability - consistent with an authorization bypass or privilege escalation flaw within the access control layer. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical data assets to unauthenticated network attackers via HTTP, enabling both full read access to all application-accessible data and unauthorized creation, deletion, or modification of critical records. The vulnerability resides in the Access and security component and is tagged as an authentication bypass by Oracle. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the high confidentiality and integrity impact with no authentication prerequisite elevates its priority for affected deployments.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all DRM-managed master data to unauthenticated remote attackers over HTTPS. The flaw resides in the Access and Security component - the gatekeeper for the application - and permits complete read access to critical DRM data alongside limited unauthorized write capability. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS vector (PR:N, AC:L) confirms trivial unauthenticated exploitability from any network-adjacent position with HTTPS reachability.
Unauthorized data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows unauthenticated network attackers to access the complete dataset managed by the platform via HTTP, without requiring credentials or user interaction. The vulnerability resides in the Access and Security component and has been tagged as an Authentication Bypass, indicating a fundamental failure in access control rather than a logic edge case. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low attack complexity and absence of authentication prerequisites make this an attractive reconnaissance target.
Improper access control in Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables a local attacker to bypass application-level authentication and gain full read and write access to all DRM-managed data. The affected component is the Access and Security module (CWE-284), meaning the flaw sits at the authorization enforcement layer rather than in data processing logic. No public exploit or active exploitation is confirmed; SSVC rates technical impact as total, making successful compromise highly damaging despite the local attack vector requirement.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged, network-based attacker to bypass access controls via a crafted SQL interaction, resulting in full confidentiality and integrity compromise of critical DRM data. The scope change (S:C) in the CVSS vector indicates successful exploitation can significantly impact additional Oracle products beyond DRM itself. No public exploit code or CISA KEV listing is identified at time of analysis, though the 'Authentication Bypass' tag signals the vulnerability undermines a core security control.
Oracle Hyperion Data Relationship Management version 11.2.25.0.000 exposes a network-exploitable flaw in its Access and Security component that allows low-privileged authenticated attackers to achieve full read and write access to critical master data and propagate impact across additional Oracle Hyperion components via a scope change. Oracle assigned a CVSS 8.2 base score and tagged the issue as an authentication bypass, indicating a breakdown in authorization enforcement rather than a trivial credential attack. No public exploit code or CISA KEV listing exists at time of analysis, but the scope change and high confidentiality and integrity impacts make this a priority patch target for organizations running integrated Hyperion environments.
Unauthenticated remote data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a network-adjacent or internet-facing attacker to read critical data or achieve complete unauthorized read access to all DRM-accessible data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Access and Security component and is classified as an authentication bypass by the reporting source. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic against any exposed instance.
Unauthorized data disclosure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible financial hierarchy and metadata to unauthenticated remote attackers over HTTP, with no user interaction required. The flaw resides in the Access and Security component and is classified as an authentication bypass, enabling complete confidentiality compromise of the DRM platform's data assets without any credential requirement. No public exploit has been identified at time of analysis, but the absence of authentication barriers and low attack complexity make this a credible remote threat against any network-exposed deployment.
Unauthenticated remote access to all data in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible via a network-reachable HTTP endpoint due to an authentication bypass in the Access and Security component. An unauthenticated attacker with network access can exploit this to obtain complete read access to all data managed by the affected DRM instance, including potentially sensitive master data such as financial hierarchies, organizational structures, and governance metadata. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible master data to unauthenticated remote attackers over HTTP, with additional limited write capability (insert, update, delete). The flaw resides in the Access and Security component, and Oracle's own advisory classifies it as 'easily exploitable' with a PR:N/AC:L attack vector - meaning any network-reachable instance requires no credentials or special conditions to exploit. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a high-priority patch target for enterprises running Oracle Hyperion.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated attackers over HTTP, with no interaction required beyond initial access. The vulnerability resides in the Access and Security component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad network accessibility make this a credible internal threat vector for any organization running the affected version.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, with confirmed scope change affecting additional Oracle ecosystem products. The vulnerability resides in the Access and Security component, and successful exploitation results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS base score of 8.5 and scope-change designation make this a priority for organizations running Oracle Hyperion environments.
Unauthenticated data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a remote attacker to read, create, delete, or modify all data accessible to the application via its SOAP interface. The flaw sits in the Access and security component and is tagged as an authentication bypass, meaning an attacker needs no credentials to reach critical master-data records. No public exploit identified at time of analysis, but the CVSS 9.1 rating and unauthenticated network vector make this a high-priority patch.
Unauthorized data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) lets a remote, unauthenticated attacker read, create, delete, or modify any DRM-accessible data over HTTP. The vendor tags this as an authentication bypass, and its CVSS 3.1 score of 9.1 reflects complete confidentiality and integrity loss with no availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and no-privileges vector make it a high-priority patching target.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 permits a low-privileged, network-adjacent attacker to achieve full confidentiality and integrity compromise of critical master data, with a confirmed scope change that can propagate impact to additional Oracle Hyperion components. Exploitation via HTTP requires a victim to take some form of interactive action, placing this in a phishing or session-hijacking attack pattern. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has published a Critical Security Patch Update advisory for August 2026 addressing this flaw.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged, network-adjacent attackers over HTTP, with no user interaction required. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, enabling an attacker who holds minimal credentials to escalate their effective access to critical or all DRM-accessible data - achieving both full confidentiality and full integrity compromise without triggering availability disruption. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and lack of user interaction make exploitation straightforward for any authenticated user.
Complete takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by remote, unauthenticated attackers over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can reach beyond DRM into additional connected products. No public exploit code has been identified at time of analysis, but the trivial exploitability (no authentication, low complexity) makes this a top-priority patch.
Local privilege escalation in Oracle Hyperion Data Relationship Management (DRM) version 11.2.25.0.000 allows a low-privileged attacker with established local infrastructure access to fully compromise the DRM system, with confirmed potential for scope change affecting additional Oracle Hyperion products. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H/I:H/A:H) reflects both the restricted attack surface - requiring local logon - and the significant blast radius if successfully exploited. No public exploit identified at time of analysis, and the high attack complexity further constrains real-world exploitation.
Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes an access control bypass in its 'Access and security' component that permits low-privileged authenticated users, reachable over HTTP, to gain unauthorized read access to all application data and unauthorized write access enabling creation, deletion, or modification of critical data. Tagged as an Authentication Bypass by the advisory, the flaw delivers CVSS 3.1 High severity (8.1) with combined confidentiality and integrity impact against an enterprise master data management platform. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with confirmed impacts across confidentiality, integrity, and availability. The flaw resides in the Access and Security component, pointing to an authorization defect - likely privilege escalation or access control bypass - that allows any authenticated user to compromise the entire application. No public exploit has been identified at time of analysis, but the CVSS 8.8 score, low attack complexity, and Oracle's 'takeover' impact language make this a high-priority remediation target for organizations running financial master data management environments.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible when an attacker who already holds high application privileges sends crafted requests over the network via HTTPS to the Access and security component. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond DRM itself, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover is possible in Oracle Hyperion Data Relationship Management version 11.2.25.0.000 via a network-exploitable flaw in the Access and Security component. A low-privileged authenticated attacker with HTTP access can, under high-complexity conditions, achieve complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog; the high attack complexity (AC:H) meaningfully reduces the realistic exploitation probability despite the severe potential impact.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by any low-privileged, network-accessible attacker via HTTP, with high impact across confidentiality, integrity, and availability. The vulnerability resides in the Access and Security component and carries a vendor-assigned CVSS 3.1 base score of 8.8, reflecting low attack complexity and no required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full remote takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by an unauthenticated attacker who can reach the service over the network via TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Unauthenticated remote compromise of Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) allows network attackers to read, create, modify, or delete all data accessible to the application over HTTP without any credentials. Oracle rates it CVSS 3.1 9.1 and tags it as an authentication bypass, meaning an attacker who can reach the web interface gains full confidentiality and integrity impact over master-data governance records. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Full product takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over TCP, per Oracle's Critical Patch Update advisory (CSPU August 2026). The flaw resides in the Access and security component and yields complete confidentiality, integrity, and availability compromise (CVSS 3.1 base 9.8). No public exploit identified at time of analysis, and it is not currently listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch item.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.23.0.000 exposes its Web Client - Unicode component to unauthenticated remote attackers over HTTP. Exploitation allows complete read access to all DRM-accessible data - which in a master data management context often includes sensitive financial hierarchies and organizational structures - plus the ability to induce a partial denial of service. No public exploit has been identified at time of analysis, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially low attack complexity with no authentication barrier.
Local authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged attacker with logon access to the hosting infrastructure to read critical or all DRM-accessible data, with scope change indicating spillover exposure to additional integrated Oracle Hyperion components. The CVSS 3.1 score of 6.5 reflects the local attack vector with high confidentiality impact (C:H) and a notable scope change (S:C), meaning data exposure is not confined to the DRM application alone. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a high-privileged attacker with network access via HTTP, exploiting a flaw in the Access and Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, consistent with a CVSS 3.1 score of 6.6 that is tempered by high attack complexity and high privilege prerequisites. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services). Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Epss exploitation probability 72.2% and no vendor patch available.
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable.
Vulnerability in the Hyperion Data Relationship Management component of Oracle Hyperion (subcomponent: Access and Security). Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Hyperion Data Relationship Management component of Oracle Hyperion (subcomponent: Access and security). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Hyperion Data Relationship Management component of Oracle Hyperion (subcomponent: Access and security). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unauthenticated denial of service in Oracle Hyperion Data Relationship Management 11.2.26.0.000 lets any attacker who can reach the HTTP interface hang or repeatedly crash the application, removing master-data services for all legitimate users. Oracle rates it CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only), and the vulnerable code sits in the 'Access and security' component, so no credentials or user interaction are needed. Active exploitation is not confirmed — no KEV listing, EPSS score, or public exploit code was supplied with this report — but the low attack complexity makes automated mass scanning plausible if the endpoint is internet-reachable.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access-and-security flaw that lets a high-privileged attacker reach the application over HTTP and create, delete or modify critical master-data records while also reading data they should not be able to reach. The CVSS 3.1 score is 7.7 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-trigger but high-impact condition that also escapes the product boundary and can affect other Oracle products. No public exploit code or CISA KEV entry was identified, and exploitation requires an already high-privileged account, so this is a privileged-insider or post-compromise escalation and data-integrity risk rather than a mass-exploited remote flaw.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 exposes an access-and-security weakness that lets a low-privileged, authenticated user reach data they should not see and alter records they should not touch. The flaw is reachable over the network through ordinary HTTP requests with no user interaction, and Oracle rates it 7.1 with high confidentiality impact and partial integrity impact. Exploitation grants read access to critical master-data content and limited unauthorized insert, update, or delete capability; no public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 is vulnerable to an unauthenticated, network-reachable flaw in its Access and Security component that lets an attacker read sensitive data, modify or delete records, and partially disrupt service availability via crafted HTTP requests. The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable remote access with no credentials or user interaction, though the confidentiality, integrity and availability impacts are each rated Low rather than total compromise. No public exploit code or CISA KEV listing was present in the provided intelligence at time of analysis, so exploitation status is best characterized as no public exploit identified at time of analysis.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access-control flaw in its Access and security component, tagged as an authentication bypass. A low-privileged authenticated attacker with network access to the HTTP interface can, by inducing a separate user to interact with crafted content, cross a trust boundary and obtain unauthorized access to critical data or complete access to all accessible data, plus limited update/insert/delete privileges. Exploitation requires a valid low-privilege account (PR:L) and human interaction (UI:R), and no public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 base score is 7.6.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.26.0.000 contains a hard-to-exploit flaw in the product's Access and Security component that lets an unauthenticated attacker reachable over TCP create, delete or modify critical master data and read the full contents of the application. CVSS 3.1 scores it 7.4 with Confidentiality and Integrity both High, but only because no public exploit code and no CISA KEV entry exist does this remain an integrity-focused patching priority rather than an emergency. There is no public exploit identified at time of analysis and no EPSS score was supplied.
Unauthorized creation, deletion, and modification of critical master data plus partial denial of service in Oracle Hyperion Data Relationship Management 11.2.26.0.000 can be triggered by an unauthenticated attacker with network access over HTTPS, provided a victim other than the attacker is persuaded to interact with attacker-supplied content. The flaw sits in the Access and Security component, scores 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L), and carries no confidentiality impact - the damage is data integrity and reduced availability. There is confirmed actively exploited (CISA KEV)? No - no public exploit identified at time of analysis, and no EPSS or KEV data was supplied; Oracle has published a Critical Security Patch Update advisory covering supported versions.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 allows an authenticated low-privileged attacker with network HTTP access to bypass access controls in the 'Access and security' component and read critical data, up to and including everything the affected DRM instance can reach, with no user interaction required. The impact is confidentiality-only (CVSS 3.1 7.7, C:H/I:N/A:N) but carries a scope change (S:C), meaning the data exposed can extend beyond DRM into additional integrated Oracle products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the low-privileged account prerequisite keeps this a genuine but moderate-priority risk for organizations running the affected release in enterprise master-data deployments.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and Security component that allows a low-privileged, authenticated user with HTTP network access to escalate privileges and take over the application, with high impact to confidentiality, integrity and availability. The vulnerability is rated 'difficult to exploit' by Oracle (AC:H), so successful abuse requires favorable conditions rather than a single trivial request, but the payoff is full compromise of the DRM instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle has published a fix in its Critical Patch Update advisory.
Privilege escalation and full application takeover in Oracle Hyperion Data Relationship Management 11.2.26.0.000, where a low-privileged attacker with network access over HTTP can compromise the Access and Security component, resulting in complete loss of confidentiality, integrity, and availability of the product (CVSS 3.1 base 7.5). Exploitation is assessed as difficult (AC:H), consistent with a security-logic or state/timing-dependent flaw rather than a simple injection, and no public exploit code or CISA KEV entry was identified at time of analysis. The practical risk concentrates in large finance and EPM environments where DRM holds authoritative master-data hierarchies and is reachable by ordinary business users.
Unauthenticated denial of service in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 lets any attacker who can reach the product's SOAP interface send crafted requests that hang or repeatedly crash the service, wiping out availability of the master-data hub. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) in the Access and Security component, with no confidentiality or integrity impact. No public exploit code and no CISA KEV listing were present in the supplied intelligence, so exploitation status is unknown; the flaw is trivially automatable once patch details are reverse-engineered.
A low-privileged, authenticated attacker with HTTP access to Oracle Hyperion Data Relationship Management 11.2.26.0.000 can abuse the Access and security component to gain unauthorized read of critical data and make unauthorized updates or deletions, provided a separate user is induced to interact with attacker-supplied content. The CVSS 3.1 score of 7.6 includes a scope change, meaning a successful attack can significantly impact other Oracle Hyperion components that consume DRM data. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no CWE, CPE, EPSS, or KEV data was supplied with this report.
Unauthenticated attackers who can reach the Oracle Hyperion Data Relationship Management web interface over HTTP can bypass the product's access and security controls in version 11.2.26.0.000 and read any data the application itself can reach, giving complete confidentiality loss for that deployment with no integrity or availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the vulnerability is tagged as an authentication bypass, meaning exploitation requires no credentials, no user interaction and no special complexity. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied in the source data, so the immediate driver is the trivial unauthenticated network exposure rather than confirmed active exploitation.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains an access-control weakness in its Access and Security component that lets a network-positioned attacker holding only a low-privileged account read or fully extract critical master-data records and make limited unauthorized updates to them. Oracle's own CVSS 3.1 rating is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting complete compromise of confidentiality within the application scope but only partial integrity impact, with no availability effect. No public exploit code, EPSS score, or CISA KEV listing was supplied with the available intelligence, so active exploitation is unconfirmed; the only authoritative source is Oracle's security alert at https://www.oracle.com/security-alerts/cspusep2026.html.
Insufficient access controls in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 let a low-privileged, network-positioned user read data far beyond their granted role, including all data the DRM service can access. The flaw sits in the 'Access and security' component and carries a scope change, meaning compromised instances can become a pivot into additional Oracle Hyperion/EPM products that trust the DRM service. Oracle's CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no CISA KEV listing, public exploit code, or EPSS score was present in the supplied intelligence, so exploitation appears neither confirmed nor publicly demonstrated at time of analysis.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 lets a high-privileged, network-positioned user defeat the Access and security component and reach well beyond their intended authorization boundary - reading critical master data and gaining update/insert/delete capability over data they should not control. Exploitation is low-complexity (AC:L) and requires no user interaction (UI:N), but it is gated behind a pre-existing high-privilege account on the DRM instance (PR:H), and because the vector carries a scope change (S:C), success can cascade into connected EPM and finance systems that trust DRM as a source of record. No public exploit code or confirmed active exploitation has been identified at time of analysis, and with an EPSS-style signal absent the 7.6 High rating rests almost entirely on the CVSS vector rather than on observed threat activity.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an easily exploitable flaw in its Access and Security component that lets a low-privileged, network-positioned attacker compromise the application via HTTP. Successful exploitation requires a victim user to interact with attacker-supplied content, but yields high confidentiality impact (unauthorized read of critical DRM data) plus limited integrity impact, and the scope change means other Oracle Hyperion components or integrated products may also be affected. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so active exploitation is unconfirmed; severity is driven by the CVSS 3.1 base score of 7.6.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 exposes critical master-data through a flaw in its Access and Security component that lets a low-privileged, network-connected attacker read and partially modify data after inducing another user to interact. The CVSS 3.1 vector (7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) indicates the compromise can spill into other connected Hyperion products because of the scope change, with confidentiality impact rated high. No public exploit code or CISA KEV entry is present in the supplied intelligence, so this is currently a patch-now compliance issue rather than a confirmed active-exploitation emergency.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an authentication bypass in the Access and Security component that can be reached over the network through SMTP, allowing an unauthenticated attacker to create, delete, or modify critical data and to read the entirety of the application's accessible data. Oracle's security alert rates it 7.4 with high confidentiality and integrity impact but high attack complexity, indicating the exploit path is non-trivial even though no credentials or user interaction are required. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor-published advisory and the absence of any availability impact make this a targeted-tampering risk for finance and master-data teams rather than a broad worm-style threat.
Authentication bypass in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 lets an unauthenticated remote attacker with HTTP access to the DRM web tier read and modify the application's master data without supplying valid credentials. The flaw sits in the 'Access and security' component and carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no privileges, no user interaction, and low attack complexity are required; availability is explicitly not impacted (A:N). No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), but CISA's SSVC assessment rates it automatable with total technical impact, and EUVD tracks it as EUVD-2026-79784 - making it a high-priority item for any organization exposing DRM beyond a trusted internal network.
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Data Relationship Management version 11.2.26.0.000 (component: Access and security) to create, delete, or modify critical data and fully access all data accessible through the product via HTTP. This high-severity flaw (CVSS 9.1, CWE-287) requires no authentication, no user interaction, and low attack complexity, though practical exposure is limited to deployments where the DRM web interface is network-reachable. No public exploit code has been identified at time of analysis and it is not confirmed as actively exploited (CISA KEV); the SSVC assessment rates exploitation as none, automatable as yes, and technical impact as total.
Unauthenticated adjacent-network exploitation of Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables complete read and write access to all master data managed by the platform. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, allowing an attacker positioned on the same physical communication segment to exfiltrate sensitive hierarchical reference data and silently manipulate or delete critical records without credentials or user interaction. No public exploit has been identified at time of analysis and no CISA KEV listing has been observed, but the low attack complexity and absence of any authentication requirement make this a meaningful priority for organizations co-locating DRM with other internal systems on shared network segments.
Oracle Hyperion Data Relationship Management (DRM) 11.2.25.0.000 exposes a high-severity access control flaw that allows a low-privileged, network-authenticated attacker to fully compromise confidentiality and integrity of critical DRM data, with scope change extending impact to additional Oracle Hyperion products. Exploitation requires human interaction from a victim user, consistent with a cross-site or cross-context attack pattern (the 'Authentication Bypass' tag suggests privilege escalation beyond the attacker's initial access tier). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and integrity compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a local attacker holding low-privilege infrastructure credentials to fully circumvent application-level access controls, yielding complete read and write access to all DRM-managed master data. The vulnerability resides in the Access and security component and is tagged as an Authentication Bypass, suggesting internal authorization enforcement fails once basic OS-level access to the host is obtained. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical master data to unauthenticated remote attackers over HTTP. Exploitation requires human interaction from a victim user - consistent with a reflected or client-side attack vector - allowing an attacker to read or tamper with all data accessible within the DRM platform, including sensitive master data governance records. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this issue.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes the Access and Security component to unauthenticated remote attackers over HTTP, enabling full read and write access to critical master data hierarchies. The CVSS 3.1 score of 8.7 reflects a scope change (S:C), meaning successful exploitation can cascade to additional Oracle Hyperion EPM products beyond the initial target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirement and cross-component impact warrants prompt remediation.
Full system takeover in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated network attackers via HTTP, targeting the Access and Security component. Oracle's own advisory characterizes this as 'easily exploitable,' with successful exploitation resulting in complete compromise across confidentiality, integrity, and availability - consistent with an authorization bypass or privilege escalation flaw within the access control layer. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical data assets to unauthenticated network attackers via HTTP, enabling both full read access to all application-accessible data and unauthorized creation, deletion, or modification of critical records. The vulnerability resides in the Access and security component and is tagged as an authentication bypass by Oracle. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the high confidentiality and integrity impact with no authentication prerequisite elevates its priority for affected deployments.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all DRM-managed master data to unauthenticated remote attackers over HTTPS. The flaw resides in the Access and Security component - the gatekeeper for the application - and permits complete read access to critical DRM data alongside limited unauthorized write capability. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS vector (PR:N, AC:L) confirms trivial unauthenticated exploitability from any network-adjacent position with HTTPS reachability.
Unauthorized data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows unauthenticated network attackers to access the complete dataset managed by the platform via HTTP, without requiring credentials or user interaction. The vulnerability resides in the Access and Security component and has been tagged as an Authentication Bypass, indicating a fundamental failure in access control rather than a logic edge case. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low attack complexity and absence of authentication prerequisites make this an attractive reconnaissance target.
Improper access control in Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables a local attacker to bypass application-level authentication and gain full read and write access to all DRM-managed data. The affected component is the Access and Security module (CWE-284), meaning the flaw sits at the authorization enforcement layer rather than in data processing logic. No public exploit or active exploitation is confirmed; SSVC rates technical impact as total, making successful compromise highly damaging despite the local attack vector requirement.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged, network-based attacker to bypass access controls via a crafted SQL interaction, resulting in full confidentiality and integrity compromise of critical DRM data. The scope change (S:C) in the CVSS vector indicates successful exploitation can significantly impact additional Oracle products beyond DRM itself. No public exploit code or CISA KEV listing is identified at time of analysis, though the 'Authentication Bypass' tag signals the vulnerability undermines a core security control.
Oracle Hyperion Data Relationship Management version 11.2.25.0.000 exposes a network-exploitable flaw in its Access and Security component that allows low-privileged authenticated attackers to achieve full read and write access to critical master data and propagate impact across additional Oracle Hyperion components via a scope change. Oracle assigned a CVSS 8.2 base score and tagged the issue as an authentication bypass, indicating a breakdown in authorization enforcement rather than a trivial credential attack. No public exploit code or CISA KEV listing exists at time of analysis, but the scope change and high confidentiality and integrity impacts make this a priority patch target for organizations running integrated Hyperion environments.
Unauthenticated remote data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a network-adjacent or internet-facing attacker to read critical data or achieve complete unauthorized read access to all DRM-accessible data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Access and Security component and is classified as an authentication bypass by the reporting source. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic against any exposed instance.
Unauthorized data disclosure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible financial hierarchy and metadata to unauthenticated remote attackers over HTTP, with no user interaction required. The flaw resides in the Access and Security component and is classified as an authentication bypass, enabling complete confidentiality compromise of the DRM platform's data assets without any credential requirement. No public exploit has been identified at time of analysis, but the absence of authentication barriers and low attack complexity make this a credible remote threat against any network-exposed deployment.
Unauthenticated remote access to all data in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible via a network-reachable HTTP endpoint due to an authentication bypass in the Access and Security component. An unauthenticated attacker with network access can exploit this to obtain complete read access to all data managed by the affected DRM instance, including potentially sensitive master data such as financial hierarchies, organizational structures, and governance metadata. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible master data to unauthenticated remote attackers over HTTP, with additional limited write capability (insert, update, delete). The flaw resides in the Access and Security component, and Oracle's own advisory classifies it as 'easily exploitable' with a PR:N/AC:L attack vector - meaning any network-reachable instance requires no credentials or special conditions to exploit. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a high-priority patch target for enterprises running Oracle Hyperion.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated attackers over HTTP, with no interaction required beyond initial access. The vulnerability resides in the Access and Security component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad network accessibility make this a credible internal threat vector for any organization running the affected version.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, with confirmed scope change affecting additional Oracle ecosystem products. The vulnerability resides in the Access and Security component, and successful exploitation results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS base score of 8.5 and scope-change designation make this a priority for organizations running Oracle Hyperion environments.
Unauthenticated data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a remote attacker to read, create, delete, or modify all data accessible to the application via its SOAP interface. The flaw sits in the Access and security component and is tagged as an authentication bypass, meaning an attacker needs no credentials to reach critical master-data records. No public exploit identified at time of analysis, but the CVSS 9.1 rating and unauthenticated network vector make this a high-priority patch.
Unauthorized data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) lets a remote, unauthenticated attacker read, create, delete, or modify any DRM-accessible data over HTTP. The vendor tags this as an authentication bypass, and its CVSS 3.1 score of 9.1 reflects complete confidentiality and integrity loss with no availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and no-privileges vector make it a high-priority patching target.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 permits a low-privileged, network-adjacent attacker to achieve full confidentiality and integrity compromise of critical master data, with a confirmed scope change that can propagate impact to additional Oracle Hyperion components. Exploitation via HTTP requires a victim to take some form of interactive action, placing this in a phishing or session-hijacking attack pattern. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has published a Critical Security Patch Update advisory for August 2026 addressing this flaw.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged, network-adjacent attackers over HTTP, with no user interaction required. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, enabling an attacker who holds minimal credentials to escalate their effective access to critical or all DRM-accessible data - achieving both full confidentiality and full integrity compromise without triggering availability disruption. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and lack of user interaction make exploitation straightforward for any authenticated user.
Complete takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by remote, unauthenticated attackers over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can reach beyond DRM into additional connected products. No public exploit code has been identified at time of analysis, but the trivial exploitability (no authentication, low complexity) makes this a top-priority patch.
Local privilege escalation in Oracle Hyperion Data Relationship Management (DRM) version 11.2.25.0.000 allows a low-privileged attacker with established local infrastructure access to fully compromise the DRM system, with confirmed potential for scope change affecting additional Oracle Hyperion products. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H/I:H/A:H) reflects both the restricted attack surface - requiring local logon - and the significant blast radius if successfully exploited. No public exploit identified at time of analysis, and the high attack complexity further constrains real-world exploitation.
Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes an access control bypass in its 'Access and security' component that permits low-privileged authenticated users, reachable over HTTP, to gain unauthorized read access to all application data and unauthorized write access enabling creation, deletion, or modification of critical data. Tagged as an Authentication Bypass by the advisory, the flaw delivers CVSS 3.1 High severity (8.1) with combined confidentiality and integrity impact against an enterprise master data management platform. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with confirmed impacts across confidentiality, integrity, and availability. The flaw resides in the Access and Security component, pointing to an authorization defect - likely privilege escalation or access control bypass - that allows any authenticated user to compromise the entire application. No public exploit has been identified at time of analysis, but the CVSS 8.8 score, low attack complexity, and Oracle's 'takeover' impact language make this a high-priority remediation target for organizations running financial master data management environments.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible when an attacker who already holds high application privileges sends crafted requests over the network via HTTPS to the Access and security component. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond DRM itself, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover is possible in Oracle Hyperion Data Relationship Management version 11.2.25.0.000 via a network-exploitable flaw in the Access and Security component. A low-privileged authenticated attacker with HTTP access can, under high-complexity conditions, achieve complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog; the high attack complexity (AC:H) meaningfully reduces the realistic exploitation probability despite the severe potential impact.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by any low-privileged, network-accessible attacker via HTTP, with high impact across confidentiality, integrity, and availability. The vulnerability resides in the Access and Security component and carries a vendor-assigned CVSS 3.1 base score of 8.8, reflecting low attack complexity and no required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full remote takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by an unauthenticated attacker who can reach the service over the network via TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Unauthenticated remote compromise of Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) allows network attackers to read, create, modify, or delete all data accessible to the application over HTTP without any credentials. Oracle rates it CVSS 3.1 9.1 and tags it as an authentication bypass, meaning an attacker who can reach the web interface gains full confidentiality and integrity impact over master-data governance records. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Full product takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over TCP, per Oracle's Critical Patch Update advisory (CSPU August 2026). The flaw resides in the Access and security component and yields complete confidentiality, integrity, and availability compromise (CVSS 3.1 base 9.8). No public exploit identified at time of analysis, and it is not currently listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch item.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.23.0.000 exposes its Web Client - Unicode component to unauthenticated remote attackers over HTTP. Exploitation allows complete read access to all DRM-accessible data - which in a master data management context often includes sensitive financial hierarchies and organizational structures - plus the ability to induce a partial denial of service. No public exploit has been identified at time of analysis, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially low attack complexity with no authentication barrier.
Local authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged attacker with logon access to the hosting infrastructure to read critical or all DRM-accessible data, with scope change indicating spillover exposure to additional integrated Oracle Hyperion components. The CVSS 3.1 score of 6.5 reflects the local attack vector with high confidentiality impact (C:H) and a notable scope change (S:C), meaning data exposure is not confined to the DRM application alone. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a high-privileged attacker with network access via HTTP, exploiting a flaw in the Access and Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, consistent with a CVSS 3.1 score of 6.6 that is tempered by high attack complexity and high privilege prerequisites. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services). Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Epss exploitation probability 72.2% and no vendor patch available.
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable.
Vulnerability in the Hyperion Data Relationship Management component of Oracle Hyperion (subcomponent: Access and Security). Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Hyperion Data Relationship Management component of Oracle Hyperion (subcomponent: Access and security). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Hyperion Data Relationship Management component of Oracle Hyperion (subcomponent: Access and security). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.