This vulnerability affects Oracle Hyperion Calculation Manager 11.2.25.0.000 and involves an easily exploitable security flaw that permits an unauthenticated attacker with infrastructure logon to compromise the application. Successful exploitation results in unauthorized read access to a subset of data accessible by the product. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates the attack requires local access with low complexity and no privileges or user interaction, impacting confidentiality only. Oracle's advisory references this issue as part of their August 2026 Critical Security Patch Update but does not provide a direct patch link for this specific vulnerability.

The impact is unauthorized disclosure of some data within Oracle Hyperion Calculation Manager, limited to confidentiality without affecting integrity or availability. The attacker must have logon access to the infrastructure hosting the product, which restricts the attack surface. There are no known exploits in the wild. The medium severity score reflects the limited scope and required access level.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update process. Although no direct patch link is provided for this specific vulnerability, customers should ensure they are running supported versions and apply the latest Oracle Critical Security Patch Updates to mitigate this and other vulnerabilities. No vendor advisory states that no action is required or that the issue is already mitigated, so patching is advised when available.