This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 and is classified under CWE-306 (Missing Authentication for Critical Function). It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in full takeover of the Oracle Hyperion Calculation Manager. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, causing high impact on confidentiality, integrity, and availability.

Successful exploitation leads to complete compromise of Oracle Hyperion Calculation Manager, allowing an attacker to take over the system with full control, impacting confidentiality, integrity, and availability of the affected product.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying patches without delay. Patch availability and installation instructions can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.