This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 and is exploitable by a low privileged attacker over the network via HTTP. The flaw allows unauthorized creation, deletion, or modification of critical data, with a scope change that may impact other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. Oracle has published a Critical Security Patch Update advisory recommending patch application but has not explicitly confirmed patch availability for this specific vulnerability in the provided advisory content.

Exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Calculation Manager and potentially affect other Oracle products. The confidentiality and integrity of data are severely impacted, while availability is not affected. This could lead to significant data compromise within affected environments.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although the advisory does not explicitly confirm a patch for this specific vulnerability, customers should review the Oracle Critical Security Patch Update advisory dated August 2026 and apply relevant patches without delay. Staying on actively supported versions and timely patching are critical to mitigating this vulnerability.