Hyperion Calculation Manager CVE-2026-70677

Exploitation requires that Oracle Hyperion Calculation Manager version 11.2.25.0.000 is accessible over HTTP from a network reachable by the attacker. Critically, the attack requires active human interaction from a person other than the attacker - meaning a legitimate user must take some action (e.g., click a link, visit a page, or trigger a specific application state) for the bypass to succeed; unaided automated exploitation is not possible given UI:R. The high attack complexity (AC:H) further indicates that beyond user interaction, specific timing, environmental conditions, or configuration state must align for the exploit to succeed. Exploitation is limited by: (1) the requirement for victim user interaction, (2) high attack complexity precluding trivial or automated mass exploitation, (3) scope unchanged (S:U), meaning compromise is bounded to Hyperion Calculation Manager data and does not inherently pivot to other system components. Availability impact is absent - this attack does not disrupt service.

The CVSS 3.1 base score of 5.9 reflects a Medium-severity rating, but the signal composition warrants careful interpretation. The high confidentiality impact (C:H) means a successful attack could expose all data accessible to Hyperion Calculation Manager, which in EPM environments often includes sensitive financial planning, budget, and forecasting data. However, the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce real-world exploitability - this is not a spray-and-pray attack; it requires either social engineering of a target user or exploitation of a specific race condition or environmental state. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified. KEV status is not confirmed, and no public proof-of-concept has been identified, meaning this is assessed as low-urgency opportunistic risk rather than an active threat. The absence of a CWE assignment reduces confidence in root-cause classification. The realistic threat model is a targeted attack against organizations using Oracle Hyperion, likely involving phishing or malicious link delivery to a logged-in or authenticated-session user.

An attacker identifies an organization running Oracle Hyperion Calculation Manager 11.2.25.0.000 accessible over HTTP, then crafts a malicious URL or page that exploits the authentication bypass flaw. The attacker delivers this link to a Hyperion user - via phishing email or a compromised internal resource - and when the victim interacts with it, the authentication bypass is triggered, granting the attacker read access to the victim's Hyperion data and limited write access. No public exploit code has been identified, meaning this scenario requires attacker-developed tooling or exploitation knowledge derived from reverse-engineering the patch.