This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and involves a security flaw that can be exploited remotely without authentication but requires user interaction. The attack vector is network-based over HTTP with low attack complexity and no privileges required. The vulnerability impacts confidentiality and integrity, allowing attackers to gain unauthorized access and modify critical data within the product. The CVSS 3.1 base score is 8.1, reflecting a high severity. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory, which includes numerous patches across Oracle products, but no explicit patch link for this specific vulnerability was provided in the input data.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Calculation Manager. It can lead to complete unauthorized access to all data accessible by the product, compromising confidentiality and integrity. There is no reported availability impact. The vulnerability requires user interaction, which may limit automated exploitation but still poses a significant risk.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update, which addresses this and many other vulnerabilities. Customers should ensure they are running actively supported versions and apply security patches promptly to mitigate this risk. Since the input does not provide a direct patch link for this specific vulnerability, users must consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions. No indication was given that the vulnerability is already mitigated or requires no action.