This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 and is classified under CWE-284 (Improper Access Control). It enables a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data within Oracle Hyperion Calculation Manager. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) highlights network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. The vendor advisory is part of Oracle's August 2026 Critical Security Patch Update, which includes numerous patches across Oracle products. However, no explicit patch link or version fix is provided for this specific vulnerability in the advisory.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Hyperion Calculation Manager, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability's scope change indicates potential impact on additional Oracle products beyond Hyperion Calculation Manager.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update, which addresses this and many other vulnerabilities. Customers should remain on actively supported versions and apply security patches promptly to mitigate this vulnerability. Since the advisory does not specify a direct patch link for this version, users should consult Oracle's official patch availability documentation for Oracle Hyperion Calculation Manager version 11.2.25.0.000 and apply the relevant updates without delay.