This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 and involves improper access control allowing a high privileged attacker with network access via SQL to gain unauthorized update, insert, delete, and read access to some data accessible by the product. The CVSS 3.1 base score is 3.8 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts without availability impact. Oracle has addressed this vulnerability in their August 2026 Critical Security Patch Update.

Successful exploitation allows unauthorized read and write access to some data within Oracle Hyperion Calculation Manager, potentially compromising data confidentiality and integrity. The impact is limited to data accessible by the product and requires a high privileged attacker with network access. There is no impact on availability. No known active exploitation has been reported.

Oracle has released a security patch for this vulnerability as part of the August 2026 Critical Security Patch Update. Users of Oracle Hyperion Calculation Manager version 11.2.25.0.000 should apply the official patch promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities.