Hyperion Calculation Manager CVE-2026-62446

Exploitation requires HTTP network access to an exposed Oracle Hyperion Calculation Manager 11.2.25.0.000 instance - specifically, the Security component must be reachable over the network. No authentication is required, confirmed by CVSS PR:N in the vendor-supplied vector. No special non-default configuration or feature-enablement prerequisites are referenced in the description. Exploitation is strictly bounded to read-only access to a subset of data (C:L); no path to modify, delete, or crash the system is indicated. Organizations that restrict Hyperion access to internal corporate networks rather than exposing it to the internet substantially reduce real-world attacker population, as the vulnerability is otherwise exploitable from any network-adjacent position without credentials.

The CVSS 3.1 score of 5.3 (Medium) is consistent with the actual risk profile: network-accessible, unauthenticated exploitation is substantially offset by impact limited to partial, read-only data disclosure with no integrity or availability consequences. No EPSS data was supplied in the available intelligence, and the absence of a CISA KEV entry combined with no identified public exploit code suggests this vulnerability is not currently being exploited at scale. The 'Authentication Bypass' reporter tag marginally elevates real-world concern beyond the raw score, because unauthenticated access to a financial EPM system's data - even a subset - may expose budget figures, forecasting models, or organizational configuration data of business sensitivity. That said, even a mid-sized municipal IT team in gdynia running Hyperion Calculation Manager for financial consolidation should treat this as a routine patch-cycle priority rather than an emergency response, given the bounded C:L impact and absence of known active exploitation. No conflicting signals exist between the CVSS vector and the vulnerability description - both consistently indicate a straightforward unauthenticated HTTP read-access bypass.

An unauthenticated remote attacker with HTTP network access to a Hyperion Calculation Manager 11.2.25.0.000 instance sends crafted HTTP requests to an endpoint within the Security component, bypassing authentication controls to retrieve a subset of application data such as user metadata, calculation rule definitions, or financial planning configuration. No public exploit code has been identified at time of analysis, meaning the attacker must independently discover the vulnerable endpoint and bypass logic. The low attack complexity (AC:L) suggests that once the target endpoint is identified, exploitation would not require specialized tooling or multi-step staging.