Hyperion Calculation Manager CVE-2026-62441

The attacker must hold a valid low-privilege authenticated account with network access to the Oracle Hyperion Calculation Manager instance via HTTP - fully unauthenticated exploitation is not supported by the CVSS PR:L metric. The vulnerability is specific to version 11.2.25.0.000 of the Security component; other versions are not confirmed affected by the available data. No user interaction from a victim is required (UI:N). Exploitation is bounded to the data accessible to the Hyperion instance - read and write operations are limited to a subset of EPM data, not arbitrary system-level access. Deployment in network-segmented enterprise environments - standard practice for Oracle EPM infrastructure - further restricts the realistic attacker pool to internal users or those with prior lateral access. No special non-default configuration is indicated as a prerequisite.

The CVSS 3.1 score of 5.4 (Medium) is internally consistent: network-reachable (AV:N), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), with partial confidentiality and integrity impacts and no availability impact (C:L/I:L/A:N). A notable tension exists between the 'authentication bypass' tag and the PR:L metric - an authentication bypass label typically implies circumventing authentication entirely, yet PR:L confirms that a low-privilege authenticated session is still the entry point. This suggests the bypass is a privilege escalation or access control bypass within an authenticated context rather than a full pre-authentication exploit. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. No POC is publicly known. Oracle Hyperion EPM is typically deployed in network-segmented enterprise financial environments, which substantially limits exposure to external attackers. The realistic threat actor pool is restricted to authenticated insiders or accounts compromised after initial access - making this a meaningful insider-threat or post-breach lateral-movement risk rather than an opportunistic internet-facing threat.

An attacker holding a valid low-privilege Hyperion account - such as a financial analyst with read-only access - sends crafted HTTP requests to the Security component of Oracle Hyperion Calculation Manager, exploiting the access control bypass to invoke data operations beyond their authorization level. The attacker is then able to read sensitive EPM data such as calculation rule configurations or financial model structures, and to insert, update, or delete records within accessible data sets. No public exploit code is known at time of analysis, but the low attack complexity (AC:L) means a knowledgeable insider could execute this without specialized tooling.