This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and requires physical network segment access to exploit, making it difficult to exploit. It allows an unauthenticated attacker to compromise the product, potentially impacting additional Oracle products due to scope change. The attack can result in unauthorized creation, deletion, or modification of critical data, with high confidentiality and integrity impacts as per CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for this version.

The vulnerability can lead to unauthorized creation, deletion, or modification of critical data accessible by Oracle Hyperion Calculation Manager, resulting in high confidentiality and integrity impacts. The scope of impact may extend to additional Oracle products. There is no impact on availability. Exploitation requires physical access to the communication segment, limiting the attack vector.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory includes many fixes but does not explicitly confirm a patch for this specific vulnerability in version 11.2.25.0.000. Patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Due to the requirement for physical network segment access, restricting physical and network access to critical hardware is a relevant mitigation.