This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and involves a security flaw in the product's security component. An unauthenticated attacker who has logon access to the underlying infrastructure can exploit this issue, but exploitation is difficult and requires user interaction from a third party. The impact includes unauthorized read and modification (update, insert, delete) of some data accessible by the application. The CVSS vector indicates local attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality and integrity impacts with no availability impact.

The vulnerability allows unauthorized read and modification of some data within Oracle Hyperion Calculation Manager, which could compromise data confidentiality and integrity. However, exploitation is difficult, requires local access to the infrastructure, and necessitates user interaction from a person other than the attacker. There is no impact on availability. The overall severity is low.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, patching must be applied by the customer. Check Oracle's official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.