Hyperion Calculation Manager CVE-2026-62606

Exploitation requires a valid low-privileged authenticated account (PR:L) on Oracle Hyperion Calculation Manager 11.2.25.0.000, with HTTP network access to the Security component. The high attack complexity (AC:H) means exploitation depends on conditions outside the attacker's direct control - such as a specific application state, race condition, or precise sequence of operations - and is not reliably reproducible on demand. The impact is restricted to reading a subset of application data (C:L); there is no path to data modification or service disruption (I:N, A:N). The authentication requirement (PR:L) and high complexity barrier (AC:H) together substantially limit the realistic attacker pool to insiders or authenticated users who can also engineer the required exploit conditions.

The CVSS 3.1 base score of 3.1 (Low) accurately reflects a constrained risk profile: while the attack vector is network-accessible (AV:N), exploitation demands high attack complexity (AC:H) and a pre-existing low-privileged authenticated account (PR:L), yielding only partial confidentiality loss with no integrity or availability impact. The AC:H rating is a meaningful barrier - it implies attacker-controlled conditions beyond a simple request, such as a race condition, specific application state, or precise request sequence, which significantly reduces opportunistic exploitation potential. No EPSS data was provided; absent that signal and given the low CVSS score, absence of KEV listing, and no confirmed POC, the real-world exploitation probability appears low. The 'Authentication Bypass' tag creates a minor tension with the PR:L CVSS metric - a true authentication bypass would typically warrant PR:N - suggesting the tag may describe the effect (bypassing authorization within an authenticated session) rather than bypassing the authentication gate itself. This discrepancy should be verified against the Oracle August 2026 CPU advisory. This vulnerability is most appropriately addressed through routine patch cycles rather than emergency response.

A low-privileged authenticated user with HTTP network access crafts specific requests targeting the Security component of Oracle Hyperion Calculation Manager 11.2.25.0.000 to trigger an authorization boundary violation, reading application data beyond their permitted scope. The AC:H rating indicates the attacker must engineer precise conditions - such as a specific application state or timing window - to successfully exploit the flaw, making automated or mass exploitation unlikely. No public exploit code has been identified at time of analysis.