This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and allows a high privileged attacker who already has logon access to the infrastructure where the product runs to compromise it. The vulnerability impacts confidentiality and integrity, potentially allowing unauthorized access to critical data and unauthorized modification of data within the product. The CVSS vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory from Oracle references this vulnerability as part of the August 2026 Critical Security Patch Update, which contains numerous security fixes. Oracle strongly recommends applying patches promptly to mitigate such vulnerabilities.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Calculation Manager. Attackers may also gain unauthorized capabilities to update, insert, or delete some of the accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that the impact may extend beyond the immediate product to other Oracle Hyperion components.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. Customers are strongly advised to apply the relevant security patches from this update promptly. The vendor advisory is the authoritative source for patch availability and installation instructions. No indication was given that the vulnerability is already mitigated or requires no action. Patch status is confirmed by the vendor advisory recommending patch application. There is no indication that this is a cloud service; therefore, patching is the responsibility of the customer.