Hyperion Calculation Manager CVE-2026-61313

Exploitation requires an attacker to hold a high-privileged account (PR:H per the vendor-supplied CVSS vector) AND have direct logon access to the physical or virtual infrastructure where Oracle Hyperion Calculation Manager 11.2.25.0.000 is running (AV:L per CVSS). The vulnerability is isolated to version 11.2.25.0.000 of the Calculation Manager product; deployments on other versions are not confirmed as in scope. No user interaction from a third party is needed once the attacker has the requisite access level. Remote unauthenticated exploitation is explicitly ruled out by the AV:L/PR:H vector combination - an attacker cannot exploit this from the network without first establishing an authenticated local session with high privileges. Organizations where Hyperion Calculation Manager infrastructure access is tightly governed by Privileged Access Management (PAM) controls face meaningfully reduced exposure.

The vendor-assigned CVSS 3.1 score of 6.7 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N accurately captures the constrained but meaningful risk profile. The PR:H requirement is the primary real-world limiter: exploitation demands an attacker already holding high-privileged credentials on the Hyperion infrastructure, narrowing the threat actor pool to malicious insiders, compromised privileged accounts, or post-exploitation lateral movement. The S:C (Scope Changed) flag elevates concern beyond the base score, as a successful attack may affect additional Oracle Hyperion products sharing the same infrastructure - a detail that deserves attention in EPM deployments where Hyperion components are tightly integrated. No EPSS score is available in the provided data, there is no CISA KEV listing, and no public exploit code has been identified, indicating this is not currently subject to mass or opportunistic exploitation. The 'Authentication Bypass' tag warrants scrutiny: given PR:H, this almost certainly describes bypassing authorization controls within the product's own security model rather than achieving unauthenticated initial access - a meaningful distinction for threat modeling. Overall, this is a genuine but operationally bounded risk, best prioritized within the context of privileged access governance and insider threat programs rather than emergency patching timelines.

An attacker holding a high-privileged service or administrative account on the Oracle Hyperion Calculation Manager infrastructure exploits a flaw in the Security component to circumvent authorization controls, reading sensitive financial models, business rules, or user configuration data that would normally be restricted even at their privilege level. The scope change means the attacker may subsequently pivot to adjacent Oracle Hyperion products - such as Planning or Financial Management - that trust the Calculation Manager's security context, potentially achieving broader EPM environment compromise from a single exploited account.