This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and involves a security flaw that can be exploited remotely over HTTP without authentication. However, successful exploitation requires user interaction from a third party. The impact is unauthorized access to critical or all accessible data within the product. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. Oracle's August 2026 Critical Security Patch Update addresses numerous vulnerabilities including this one, emphasizing the importance of applying patches promptly.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Hyperion Calculation Manager. There is no reported impact on data integrity or system availability. The attack complexity is high and requires user interaction, which reduces the likelihood of exploitation. No known exploits are reported in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Users of Oracle Hyperion Calculation Manager 11.2.25.0.000 should apply the relevant security patches from this update promptly. Since the vendor advisory does not specify a direct patch link for this version, users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions. No additional mitigation steps are indicated by the vendor advisory.