This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and is classified under CWE-284 (Improper Access Control). It permits an unauthenticated attacker who has logon access to the underlying infrastructure to compromise the product. The scope of impact extends beyond the product itself, potentially affecting additional Oracle Hyperion products. The CVSS 3.1 base score is 7.9, reflecting high confidentiality impact and low integrity impact, with no impact on availability. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 fixes and strongly urges customers to apply patches promptly.

Successful exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on Oracle Hyperion Calculation Manager accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires the attacker to have logon access to the infrastructure where the product runs, but no privileges or user interaction are required beyond that.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle without delay. The vendor advisory strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this and other vulnerabilities. No alternative or temporary mitigations are specified in the advisory.