Hyperion Calculation Manager CVE-2026-61206

Exploitation requires network access to the Calculation Manager HTTP interface plus a valid low-privileged account (CVSS PR:L) - it is not unauthenticated. No user interaction is needed (UI:N) and complexity is low (AC:L), so any authenticated low-tier EPM user can attempt it against the affected 11.2.25.0.000 build. The main limiting factors are the need for that low-privileged credential and the fact that Hyperion EPM is usually deployed on internal networks rather than internet-exposed, so an attacker must first reach the application tier; the scope change means a successful attack is not confined to Calculation Manager but can affect additional Hyperion products.

The signals point to genuinely high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes an easily exploitable, low-complexity, network-reachable attack needing only a low-privileged account, with full CIA impact and cross-product scope change - the near-maximum score is driven largely by that scope change and the low bar to entry. That said, EPM software is typically internal-facing rather than internet-exposed, so real-world exposure depends heavily on network segmentation; because Hyperion consolidates sensitive financial data, even a mid-sized municipal IT team in swidnica running an internal Hyperion stack should treat this as urgent and patch promptly. Tempering the raw score: there is no EPSS value, no KEV listing, and no public POC in the provided data, so active-exploitation pressure is currently unproven and this is not confirmed to be under attack. The 'Information Disclosure' tag understates the vector, which the CVSS metrics show as full takeover with integrity and availability loss - trust the vector over the tag here.

An attacker who holds any low-privileged Hyperion account - an insider, a compromised planning user, or an attacker who phished a routine EPM login - sends crafted HTTP requests to the Calculation Manager Security component and escalates to full control of the product. Leveraging the scope change, they pivot into connected Hyperion EPM products to read or alter sensitive financial data. No public exploit code is identified at time of analysis, and no user interaction is required.