Hyperion Calculation Manager CVE-2026-70678

Exploitation requires the attacker to hold a valid low-privileged account with network access to Oracle Hyperion Calculation Manager version 11.2.25.0.000 via HTTP - fully unauthenticated exploitation is not supported by the PR:L CVSS metric. A second prerequisite is mandatory human interaction from a person other than the attacker, meaning a legitimate Hyperion user must be induced (e.g., via phishing or social engineering) to perform an action that triggers the vulnerable code path in the Security component. The scope change impact on additional Hyperion EPM products is only realized in environments where Calculation Manager is deployed in an integrated EPM suite configuration with other Hyperion components. Limiting factors include: the authentication barrier (PR:L eliminates unauthenticated exploitation), the required victim interaction (UI:R adds a social engineering dependency), and version specificity (only 11.2.25.0.000 confirmed; no other versions identified as affected or unaffected from available data).

The CVSS 3.1 base score of 7.6 (High) is well-supported by the combination of network reachability (AV:N), low complexity (AC:L), high confidentiality impact (C:H), and scope change (S:C), which together indicate that a single successful exploitation event can expose sensitive financial data across multiple EPM components - even a mid-sized municipal IT team in malbork running Oracle Hyperion for budgeting operations should treat this as a prioritized patch cycle item. The PR:L requirement meaningfully limits the attacker pool to credentialed users, reducing opportunistic internet exploitation risk; the UI:R requirement introduces an additional social engineering dependency, further raising the bar above fully automated attack chains. EPSS data is absent from the provided intelligence, making probabilistic exploitation likelihood unknown. The vulnerability is not in CISA KEV, and no POC has been identified, so real-world exploitation has not been confirmed. The 'Authentication Bypass' tag introduces some ambiguity: if it refers to bypassing authorization (post-authentication privilege escalation) rather than bypassing authentication entirely, the PR:L vector is consistent; if it implies full authentication bypass, the CVSS vector may understate risk. This discrepancy should be clarified against the Oracle advisory or My Oracle Support patch notes.

An attacker with a valid low-privileged Oracle Hyperion account crafts a malicious HTTP request or URL targeting the Calculation Manager Security component, then delivers it to a legitimate Hyperion user via phishing or internal messaging to satisfy the UI:R requirement. Once the victim interacts with the payload, the Security component's authorization enforcement is bypassed, granting the attacker read access to all Calculation Manager data and limited write access, with potential lateral read impact on other Hyperion EPM products sharing the same environment due to the scope change.