Hyperion Calculation Manager CVE-2026-61342

Exploitation requires all of the following: (1) the target Oracle Hyperion Calculation Manager instance must be version 11.2.25.0.000 and reachable via HTTP over the network; (2) a legitimate user other than the attacker must perform a specific interaction (the exact nature of which is not described in available data - inferred from UI:R in the CVSS vector); (3) the attacker must satisfy high attack complexity conditions (AC:H), implying specific preconditions such as race conditions, specific session states, or environment dependencies. Exploitation is limited to confidentiality impact only - no integrity or availability impact. The scope is unchanged (S:U), meaning exploitation does not pivot to other system components. Authentication is not required from the attacker (PR:N per CVSS vector).

The CVSS 3.1 base score of 5.3 (Medium) reflects a meaningful but constrained risk profile: while the attack vector is network-accessible and requires no privileges (PR:N), the high attack complexity (AC:H) and mandatory human interaction (UI:R) substantially reduce realistic exploitation probability and rule out automated scanning exploitation. No EPSS score was provided in the input data, limiting quantitative exploitation likelihood assessment. There is no CISA KEV listing and no public proof-of-concept identified, indicating this is not currently under active or widespread exploitation. The confidentiality impact is rated High (C:H) with no integrity or availability impact, meaning successful exploitation yields data exposure, not system compromise or service disruption - even a mid-sized municipal IT team in kielce operating an EPM environment would face data exfiltration risk rather than operational outage. The Authentication Bypass tag elevates concern relative to the moderate base score, as authentication bypasses can sometimes be chained with other vulnerabilities. Overall, this is a genuine but not immediately critical risk, most relevant to organizations actively using Oracle Hyperion EPM in internet-exposed or multi-tenant configurations.

An attacker crafts a malicious HTTP request or resource targeting Oracle Hyperion Calculation Manager and socially engineers a legitimate authenticated user into interacting with it - for example, clicking a link or loading a crafted page - which triggers the authentication bypass in the Security component and returns sensitive financial planning data to the attacker. The high attack complexity requirement means the attacker must overcome specific technical preconditions, such as precise timing or session state, in addition to achieving the user interaction. No public proof-of-concept code has been identified at time of analysis.