This vulnerability affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 and involves a security flaw that permits an unauthenticated attacker with network access via HTTP to read a subset of accessible data without authorization. The CVSS 3.1 base score is 3.7, reflecting a low impact on confidentiality and no impact on integrity or availability. The attack complexity is high, and no privileges or user interaction are required. The vulnerability is identified as CWE-284 (Improper Access Control).

Successful exploitation results in unauthorized read access to a subset of data accessible by Oracle Hyperion Calculation Manager. There is no impact on data integrity or system availability. The vulnerability is difficult to exploit and requires network access via HTTP.

Oracle has not explicitly provided a patch link for this specific vulnerability in the advisory. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions to mitigate risks from known vulnerabilities.