This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and involves insufficient security controls in the communication segment attached to the hardware where the product executes. An unauthenticated attacker with physical network access can exploit this flaw to gain unauthorized read and write access to certain data within the application. The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates the attack requires adjacent network access with low complexity, no privileges, and no user interaction, impacting confidentiality and integrity but not availability.

An attacker with access to the physical communication segment can perform unauthorized read and write operations on some data within Oracle Hyperion Calculation Manager. This compromises the confidentiality and integrity of that data but does not affect availability. The impact is limited to the subset of data accessible by the product and requires physical network access, reducing the overall risk.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although no specific patch link is provided for this vulnerability, users should refer to the Oracle Critical Security Patch Update advisory dated August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html) for patch availability and installation instructions. Maintaining actively supported versions and timely patch application is essential to mitigate this vulnerability.