This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 and involves a security flaw that can be exploited remotely without authentication but requires user interaction. The attack vector is network-based via HTTP with high attack complexity and no privileges required. The impact includes high confidentiality loss and low integrity loss, with no impact on availability. The vulnerability is documented under CVE-2026-70677 with a CVSS score of 5.9. Oracle has published a Critical Security Patch Update advisory covering this and many other vulnerabilities but does not explicitly confirm the patch status for this specific version in the provided data.

An attacker who successfully exploits this vulnerability can gain unauthorized access to critical data or full access to all data accessible by Oracle Hyperion Calculation Manager. They may also perform unauthorized update, insert, or delete operations on some of the accessible data. The attack requires human interaction, which limits the ease of exploitation. There is no indication of availability impact.

Oracle strongly recommends applying the latest Critical Security Patch Update (CSPU) released in August 2026, which addresses this and other vulnerabilities. Customers should remain on actively supported versions and apply security patches promptly. Since the vendor advisory does not explicitly confirm patch availability for version 11.2.25.0.000, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.