This vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000 is easily exploitable by a low privileged attacker with network access via HTTP. Successful exploitation can lead to complete compromise of the Calculation Manager, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has published this in their August 2026 Critical Security Patch Update advisory, which includes numerous security fixes across products.

Successful exploitation results in full takeover of Oracle Hyperion Calculation Manager, severely impacting confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products may also be significantly impacted by attacks exploiting this vulnerability.

Oracle has included this vulnerability in their August 2026 Critical Security Patch Update advisory. Customers are strongly advised to apply the relevant security patches promptly to remediate this vulnerability. Oracle recommends remaining on actively-supported versions and applying patches without delay. Check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.