This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP could exploit this flaw, though it is considered difficult to do so. Successful exploitation may result in unauthorized creation, deletion, or modification of critical or accessible data, unauthorized read access to some data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and impacts on confidentiality (low), integrity (high), and availability (low). The vendor advisory from Oracle is available but does not explicitly confirm patch availability for this specific vulnerability. The affected version is explicitly stated as 11.2.25.0.000.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle Hyperion Calculation Manager. It can also allow unauthorized read access to a subset of accessible data and cause a partial denial of service condition. The impact affects confidentiality, integrity, and availability, with integrity impact rated high and confidentiality and availability impacts rated low.

The vendor advisory does not explicitly confirm the availability of a patch for this specific vulnerability. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Patch status is not yet confirmed for this vulnerability—check the vendor advisory for current remediation guidance.