This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and involves a security flaw in the product's security component. A low privileged attacker with network access via HTTP can exploit this vulnerability, but successful exploitation requires user interaction from a third party. The impact is limited to unauthorized modification (update, insert, delete) of some accessible data within the application. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

Successful exploitation allows unauthorized update, insert, or delete access to some data accessible by Oracle Hyperion Calculation Manager, potentially compromising data integrity. There is no impact on confidentiality or availability. The attack requires human interaction from a user other than the attacker, limiting the ease of exploitation.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No specific patch link for this product version was provided, but the vendor advisory recommends applying the latest patches without delay. There is no indication that the vulnerability is already mitigated or requires no action.