This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000. It allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Hyperion Calculation Manager and can cause a partial denial of service affecting availability. This compromises confidentiality and availability of the system.

Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory. However, no explicit patch link or fixed version is provided in the input data. Customers are strongly advised to review Oracle's August 2026 Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and apply relevant patches promptly. Patch status is not yet confirmed from the provided data; check the vendor advisory for current remediation guidance.