This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and involves a security flaw that can be exploited remotely without authentication over HTTP. Successful exploitation requires user interaction from a third party and can lead to unauthorized modification of data (update, insert, or delete) accessible by the application. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker who successfully exploits this vulnerability can gain unauthorized ability to modify data within Oracle Hyperion Calculation Manager. This could affect data integrity but does not impact confidentiality or availability. The requirement for human interaction limits the ease of exploitation.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to remediate this issue. No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, patching must be applied by the customer. Refer to Oracle's official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.