The vulnerability is located in the security component of Oracle Hyperion Calculation Manager. It allows an attacker who already possesses high‑privilege credentials and can transmit SQL commands over the network to perform unauthorized insert, update, or delete operations on the application’s data as well as read data not intended to be exposed. This results in both confidentiality and integrity impacts on the underlying database.

Oracle Hyperion Calculation Manager version 11.2.25.0.000 is the only supported release identified as affected. No other versions or related products are currently known to exhibit the flaw.

The CVSS 3.1 base score of 3.8 indicates a low risk. The exploitation requires network‑based SQL access from an attacker who already has high‑level privileges, meaning that the attack surface is limited to users with significant access. Because the vulnerability is not listed in the CISA KEV catalog and the EPSS score of 0.00257 indicates an extremely low exploitation probability, there is no current evidence of widespread exploitation, but the vulnerability remains a concern for organizations where privileged network access exists.