Oracle Hyperion Calculation Manager CVE-2026-62533

The target system must be running Oracle Hyperion Calculation Manager version 11.2.25.0.000 with the Security component exposed over HTTP on the network. No authentication is required by the attacker (PR:N per CVSS), meaning valid credentials are not a prerequisite. However, the high attack complexity (AC:H) means exploitation is not trivially repeatable - the attacker must meet conditions outside their direct control, such as a specific server state, timing dependency, or environmental prerequisite not further detailed in the available Oracle advisory. No user interaction is needed. Exploitation is constrained by: (1) the AC:H barrier requiring favorable external conditions; (2) impact limited to reading a subset of data rather than full system compromise; (3) no integrity or availability impact. Organizations not exposing Hyperion HTTP endpoints to untrusted networks face substantially reduced risk.

The CVSS 3.1 base score of 3.7 (Low) is consistent with the vector metrics: network-reachable (AV:N) and requiring no authentication (PR:N) are risk-elevating factors, but high attack complexity (AC:H) and limited confidentiality-only impact (C:L, I:N, A:N) significantly suppress the overall score. AC:H in the CVSS framework formally indicates that the attack cannot be executed at will and depends on specific conditions - such as race conditions, particular server state, or non-default configuration alignment - that the attacker cannot reliably control. No EPSS score was provided in the available data, so probabilistic exploitation likelihood cannot be quantified. There is no CISA KEV listing and no reported public proof-of-concept code, indicating no confirmed or widespread active exploitation. The 'Authentication Bypass' tag is the most risk-relevant signal: if AC:H conditions can be reliably reproduced, the absence of any authentication requirement lowers the bar for motivated attackers. However, the confined impact to 'a subset of accessible data' limits the damage radius. Overall, this is a low-priority issue for most organizations, elevated slightly for environments where Hyperion Calculation Manager stores sensitive financial or planning data accessible via HTTP.

An unauthenticated attacker with HTTP network access to Oracle Hyperion Calculation Manager 11.2.25.0.000 sends a specially crafted request that exploits a bypass in the Security component's authentication logic, potentially requiring a specific timing window or server state to succeed given the AC:H rating. Upon successful bypass, the attacker receives a response containing a subset of application data - potentially including financial models, calculation rule metadata, or user-accessible planning data - without presenting any credentials. No public proof-of-concept exploit code has been identified, suggesting this attack vector has not yet been widely operationalized.