This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 and is classified under CWE-284 (Improper Access Control). It permits an unauthenticated attacker with network access via HTTP to compromise the system, potentially resulting in complete takeover. The CVSS 3.1 base score is 8.1, indicating high severity, with impacts on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. Oracle has included this vulnerability in their August 2026 Critical Security Patch Update advisory, which contains numerous patches across multiple products. However, no direct patch link or specific fix for this vulnerability was provided in the advisory content.

Successful exploitation can lead to complete takeover of Oracle Hyperion Calculation Manager, impacting confidentiality, integrity, and availability of the system. The vulnerability allows an unauthenticated attacker to gain control over the affected product remotely via HTTP.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. This vulnerability is included in the August 2026 Critical Security Patch Update. Although no direct patch link was provided in the advisory content, users should consult the official Oracle Critical Security Patch Update documentation and apply relevant patches for Oracle Hyperion Calculation Manager version 11.2.25.0.000 without delay to mitigate this vulnerability.