Oracle Hyperion Calculation Manager CVE-2026-61259

Exploitation requires the attacker to hold a low-privileged account with network access to the Oracle Hyperion Calculation Manager web interface over HTTP. The vulnerability is in the Security component, meaning the application's authentication or authorization layer must be reachable. The 'Authentication Bypass' tag introduces ambiguity: if authentication can be bypassed within the Security component, the effective prerequisite may be reduced to unauthenticated network access rather than the PR:L metric's implication of credential possession - this must be confirmed against the full Oracle CPU advisory text. Limiting factors include: the need for network reachability to the Calculation Manager HTTP interface, the requirement for at least a low-privilege account per CVSS (absent confirmed auth bypass), and Oracle Hyperion's typical deployment in internal enterprise networks rather than public internet. No specific non-default configuration is described as a prerequisite.

The CVSS 3.1 base score of 7.1 (High) is driven by network reachability (AV:N), low complexity (AC:L), and high confidentiality impact (C:H), offset by the low-privilege requirement (PR:L) and low availability impact (A:L). The 'Authentication Bypass' tag in the ENISA EUVD intelligence data introduces tension with the PR:L metric - if authentication can be bypassed, the effective attack complexity may be lower than CVSS implies, and the privilege bar may be circumventable. This discrepancy should be verified against the full Oracle CPU advisory. No EPSS score is available in the provided data, and no KEV listing exists, indicating no confirmed active exploitation. No public proof-of-concept code has been identified. In practice, risk is modulated by the niche deployment footprint of Oracle Hyperion EPM - this is enterprise financial software not broadly internet-facing. Organizations using Hyperion Calculation Manager in internet-accessible configurations face elevated risk given the network attack vector and data sensitivity of EPM environments.

An attacker with a low-privileged account on Oracle Hyperion Calculation Manager sends a crafted HTTP request to the Security component, exploiting an authentication or authorization flaw to read sensitive EPM data such as financial models, calculation rules, or user data accessible to the application. The same or a secondary request induces partial service disruption, impacting availability for legitimate users. No public proof-of-concept exists at time of analysis, but the low complexity and 'Authentication Bypass' tag suggest exploitation would require minimal reverse-engineering effort once the flaw is understood.