This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and involves a security flaw in the product's security component. An attacker with high privileges and logon access to the underlying infrastructure can exploit this flaw to gain unauthorized ability to create, delete, or modify critical data or any data accessible by the application. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) indicates that the attack requires local access with high complexity and privileges, no user interaction, and impacts integrity without affecting confidentiality or availability.

The impact of this vulnerability is unauthorized modification of critical data or all data accessible by Oracle Hyperion Calculation Manager. There is no impact on confidentiality or availability. The attack requires high privileges and local access, making exploitation difficult but potentially damaging to data integrity if successful.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. While no specific patch link for this exact vulnerability is provided, Oracle strongly recommends applying the latest security patches promptly to mitigate this and other vulnerabilities. Customers should ensure they are running actively supported versions and apply Oracle's Critical Security Patch Updates without delay. Patch status for this vulnerability is not explicitly confirmed; check Oracle's advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.