This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and is classified under CWE-284 (Improper Access Control). An attacker with low privileges and network access via HTTP can exploit this flaw, requiring user interaction from a third party. Exploitation can result in unauthorized access to sensitive data or the ability to update, insert, or delete some data accessible by the product. The vulnerability has a CVSS 3.1 score of 7.6 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N), indicating network attack vector, low attack complexity, low privileges required, user interaction needed, scope change, high confidentiality impact, and low integrity impact. The vulnerability may also affect other Oracle products due to scope change.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Calculation Manager. Additionally, attackers may gain unauthorized ability to update, insert, or delete some data. The vulnerability's scope change means it could significantly impact other Oracle products beyond Hyperion Calculation Manager. The confidentiality impact is high, integrity impact is low, and availability is not affected.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends staying on actively supported versions and applying patches without delay. No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, remediation depends on customers applying the patch.