This vulnerability in Oracle Hyperion Calculation Manager (component: Security) version 11.2.25.0.000 allows an unauthenticated attacker who has logon access to the infrastructure where the product runs to compromise the system. The attack can result in unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Calculation Manager. The CVSS 3.1 base score is 7.1, with an attack vector of local (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope changed (S:C), and high confidentiality impact (C:H) but no impact on integrity or availability (I:N, A:N). The vulnerability may also affect other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 security fixes and strongly recommends applying patches promptly.

Successful exploitation can lead to unauthorized access to critical data within Oracle Hyperion Calculation Manager and potentially other related Oracle products due to scope change. The confidentiality of sensitive information is at high risk, but integrity and availability are not impacted. The vulnerability requires local access to the infrastructure but no privileges or user interaction, making it easily exploitable by an attacker with logon access.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the security patches without delay and remain on actively supported versions. No additional mitigation steps are specified beyond applying the official Oracle patches. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.