Hyperion Calculation Manager CVE-2026-60858

No special conditions beyond network reachability - remote unauthenticated exploitation over HTTP against version 11.2.25.0.000 of Oracle Hyperion Calculation Manager, with no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L). The primary limiting factor is network exposure: the attacker must be able to reach the Calculation Manager HTTP(S) endpoint, so deployments that keep the EPM console on isolated internal segments or behind VPN significantly reduce reachable attack surface. Exploitation is confirmed to require the affected supported version 11.2.25.0.000; applicability to other patch levels is not established in the available data.

The signals are strongly aligned toward high real-world risk: CVSS 3.1 base score 9.8 with AV:N/AC:L/PR:N/UI:N means remote, unauthenticated, low-complexity exploitation with no user interaction, and C:H/I:H/A:H indicates total compromise. Oracle itself describes it as 'easily exploitable' resulting in 'takeover,' which reinforces the vector. Countervailing context: there is no CISA KEV entry and no public proof-of-concept identified, and no EPSS score was supplied, so exploitation is not confirmed to be occurring in the wild - the priority here derives from exploitability and impact, not from observed attacks. Because EPM/Hyperion stacks handle sensitive financial consolidation and planning data and are often internally deployed, organizations running the affected version should treat this as urgent and prioritize the August 2026 CPU even though widespread mass-exploitation has not been demonstrated. If exposure to untrusted networks exists, the missing EPSS/KEV data should not delay patching given the 9.8 rating.

An attacker who can reach the Calculation Manager HTTP interface - for example an internal actor, or an external one if the EPM console is exposed - sends crafted requests to the vulnerable Security component without any credentials or user interaction, and gains administrative control of the application. From there they can read or alter financial calculation rules and consolidation logic, exfiltrate sensitive planning data, or disrupt the service. No public proof-of-concept is currently identified, so exploitation would require independent research or reverse-engineering of the patch.