This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and is characterized by an easily exploitable flaw that permits a low privileged attacker with network access over HTTP to compromise the system. Successful exploitation can lead to complete takeover of the Oracle Hyperion Calculation Manager instance. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory references multiple patches across many products but does not explicitly confirm a patch for this exact version or vulnerability in the provided content.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to fully compromise Oracle Hyperion Calculation Manager 11.2.25.0.000. This results in complete loss of confidentiality, integrity, and availability of the affected system, effectively allowing takeover of the application.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Although the advisory references a Critical Security Patch Update in August 2026, the provided data does not explicitly confirm a patch for this specific vulnerability and version. Therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, restrict network access to Oracle Hyperion Calculation Manager to trusted users only.