This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to read a subset of accessible data without authorization. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and confidentiality impact only. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly state a patch for this exact version or vulnerability in the provided content.

Successful exploitation results in unauthorized read access to some data within Oracle Hyperion Calculation Manager 11.2.25.0.000. There is no impact on integrity or availability. The confidentiality impact is limited to a subset of accessible data. No known exploits in the wild have been reported.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory includes many patches across Oracle products. However, the provided advisory content does not explicitly confirm a patch for Oracle Hyperion Calculation Manager 11.2.25.0.000 for this vulnerability. Therefore, check the vendor advisory for the latest patch availability and apply any relevant updates without delay.