This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and involves a security flaw that is difficult to exploit but allows a high privileged attacker with network access via HTTP to compromise the product. The scope of impact may extend to additional Oracle products. Successful exploitation can result in unauthorized access to critical data, unauthorized update, insert, or delete operations on accessible data, and partial denial of service conditions. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and low availability impact.

The vulnerability can lead to unauthorized access to critical data within Oracle Hyperion Calculation Manager, unauthorized modification of some data, and partial denial of service. The scope change indicates that additional Oracle products may be significantly impacted by attacks exploiting this vulnerability. The CVSS score of 7.2 reflects a high severity impact on confidentiality, with lesser impacts on integrity and availability.

Oracle has released a Critical Security Patch Update (CSPU) that includes fixes for this vulnerability. Customers are strongly advised to apply the relevant patches from the August 2026 CSPU without delay. Oracle recommends remaining on actively-supported versions and promptly applying security patches to mitigate exploitation risks. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.