This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and involves an easily exploitable security flaw that permits an unauthenticated attacker who has physical network segment access to compromise the application. The attack vector requires local network access (attack vector: adjacent network), no privileges or user interaction are needed, and the impact is high confidentiality loss without integrity or availability impact. The vulnerability is tracked as CWE-284 (Improper Access Control).

An attacker with access to the physical communication segment attached to the hardware running Oracle Hyperion Calculation Manager can gain unauthorized access to critical or all data accessible by the application. This compromises confidentiality but does not affect integrity or availability. No known exploits are reported in the wild at this time.

Oracle strongly recommends applying the relevant security patches provided in their Critical Security Patch Update (CSPU) for August 2026. Customers should ensure they are running actively supported versions and apply Oracle patches without delay to mitigate this vulnerability. The vendor advisory does not indicate that the vulnerability is already mitigated or that no action is required.