This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 and involves a security flaw in the product's security component accessible via SFTP. A low-privileged attacker with network access can exploit this difficult-to-exploit vulnerability to gain unauthorized creation, deletion, or modification access to critical data within Oracle Hyperion Calculation Manager. The vulnerability also has a scope change impact, potentially affecting additional Oracle products. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts without availability impact. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 fixes and emphasizes the importance of applying patches without delay.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Calculation Manager and potentially affect additional Oracle products due to scope change. The confidentiality and integrity of data are highly impacted, but availability is not affected. The vulnerability requires network access via SFTP and is difficult to exploit, limiting the ease of attack. No known exploits in the wild have been reported.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Since the product is not a cloud service, patching must be performed by the customer. No vendor advisory states that no action is required or that the issue is already mitigated without patching. Monitor Oracle's official security alerts for patch availability and installation instructions.