Hyperion Calculation Manager CVE-2026-62461

Network access via HTTP to an exposed Oracle Hyperion Calculation Manager 11.2.25.0.000 instance is required. Beyond network reachability, the attack complexity is rated High (AC:H), meaning exploitation depends on conditions outside the attacker's direct control - such as a specific timing window, session state, or network positioning - that are not reliably repeatable. Crucially, human interaction from a person other than the attacker is explicitly required (UI:R): a legitimate user must perform some action (e.g., visit a URL, interact with a crafted request) for the attack to succeed. Exploitation is bounded to partial confidentiality - a subset of Hyperion Calculation Manager data - with no integrity or availability impact. Limiting factors are: mandatory user interaction, high attack complexity, constrained data exposure, and unchanged scope, all of which significantly reduce real-world exploitability beyond what the network-accessible, unauthenticated attack vector alone might suggest.

The CVSS 3.1 base score of 3.1 (Low) reflects a genuinely constrained risk profile: network-accessible (AV:N) but requiring high attack complexity (AC:H) and mandatory user interaction (UI:R), with only low confidentiality impact and no integrity or availability impact. The high complexity and user interaction requirements together make automated, mass exploitation implausible. No EPSS probability score was provided, so exploitation likelihood cannot be quantified beyond what the CVSS vector implies. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified - these are consistent signals pointing to low real-world exploitation risk. The 'Authentication Bypass' tag is notable because PR:N confirms an unauthenticated attacker can initiate the attack, but the AC:H and UI:R constraints mean the bypass succeeds only under specific, hard-to-reproduce conditions. For organizations running Oracle Hyperion EPM in internet-facing or partially-exposed configurations, patching with the August 2026 CPU remains advisable, but this does not represent an emergency response priority relative to higher-severity vulnerabilities in the same advisory cycle.

An unauthenticated attacker identifies an internet- or network-accessible Oracle Hyperion Calculation Manager 11.2.25.0.000 instance and constructs a complex, multi-step HTTP request sequence targeting the Security component's authentication bypass. The attacker then social-engineers or lures a legitimate user into interacting with a crafted link or resource - such as clicking a malicious URL that triggers a cross-origin or session-context request - allowing the attacker to piggyback the user's context and read a subset of data accessible within Calculation Manager. No public exploit code has been identified, and the high complexity and required user interaction make opportunistic mass exploitation implausible.