Hyperion Calculation Manager CVE-2026-62604

Exploitation requires the attacker to be physically present on, or operating a device attached to, the specific communication segment hosting the Oracle Hyperion Calculation Manager 11.2.25.0.000 hardware, consistent with CVSS AV:A. High attack complexity (AC:H) imposes additional conditions beyond adjacency - the precise nature of which Oracle has not publicly disclosed - that must be satisfied for exploitation to succeed. The CVSS PR:N metric confirms that no credentials are required once adjacency and complexity conditions are met. Key limiting factors: mandatory network adjacency eliminates any internet-based attacker; high complexity precludes trivial or automated exploitation; impact is confined to a partial confidentiality disclosure with no write or denial-of-service capability; the specific Security component feature or protocol path exploited via the Authentication Bypass has not been disclosed by Oracle.

The CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world risk: the AV:A attack vector mandates physical or logical presence on the same network segment as the Oracle Hyperion Calculation Manager host, and AC:H imposes additional undisclosed prerequisites that rule out trivial opportunistic exploitation. The impact is strictly bounded to a subset of readable data with no integrity or availability consequences whatsoever. No EPSS score was included in the available intelligence, and this CVE is absent from CISA KEV with no known public proof-of-concept code, all of which align with the low severity designation. Even a mid-sized financial IT team in leszno operating Oracle Hyperion for enterprise planning workflows would reasonably classify this as a low operational priority, given that successful exploitation demands physical network adjacency and yields only partial data disclosure. The Authentication Bypass tag merits mild attention as it may indicate a protocol-level identity verification weakness, but Oracle's non-disclosure of the specific mechanism means the exploitation path remains inferred from available signals rather than confirmed by published technical detail.

An attacker with physical or logical access to the same LAN segment as the Oracle Hyperion Calculation Manager 11.2.25.0.000 host - such as a malicious insider, a compromised adjacent system, or a rogue device physically connected to the segment - exploits the Authentication Bypass flaw in the Security component to read a subset of accessible application data without presenting credentials. The high attack complexity means the attacker must also satisfy undisclosed secondary conditions, reducing the likelihood of opportunistic exploitation. No public proof-of-concept exists at time of analysis.