Oracle Hyperion Calculation Manager CVE-2026-62603

Exploitation requires the attacker to be physically or logically co-located on the same network segment as the Oracle Hyperion Calculation Manager 11.2.25.0.000 host - this is the hard constraint imposed by AV:A. No authentication credentials are needed (PR:N per CVSS vector), and no user interaction is required. The vulnerability is in the Security component specifically; no additional non-default configuration is described as a prerequisite in the advisory. Exploitation is limited by the adjacency requirement: attackers on the public internet cannot reach this vulnerability without first compromising a host on the internal EPM network segment. The bounded impact (C:L/I:L only) further limits what an attacker can achieve even after successful exploitation - full data exfiltration or system takeover is not indicated.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) produces a Medium score of 5.4, and the individual metrics tell a consistent story: the adjacency attack vector meaningfully constrains who can exploit this - only attackers on the same physical or logical network segment. Low complexity and no privileges required means that once network adjacency is achieved, exploitation requires no special skill or credentials. Impact is bounded to partial confidentiality and integrity (C:L/I:L) with no availability impact, suggesting read access to a data subset and limited write capability rather than full system compromise. No EPSS score was provided, no CISA KEV listing exists, and no POC code has been disclosed - making this a medium-priority patching item rather than an emergency. The greatest real-world risk is an insider threat or an attacker who has already laterally moved onto the EPM network segment potentially influencing financial planning outputs. Conflicting signals: the 'Authentication Bypass' tag implies a more impactful root cause than the limited C:L/I:L metrics suggest - this discrepancy may reflect Oracle's scoping of accessible data rather than a full bypass of all controls.

An attacker with foothold on the internal network segment hosting Oracle Hyperion Calculation Manager - such as a rogue insider or a lateral-movement attacker - sends unauthenticated HTTP or application-layer requests directly to the Security component, bypassing credential validation. The attacker then reads a subset of EPM financial calculation data or modifies records such as business rules or planning inputs, potentially corrupting budgeting outputs without triggering authentication failures. No public exploit code is known, so exploitation currently requires independent discovery or reverse-engineering of the bypass mechanism.