Hyperion Calculation Manager CVE-2026-70679

Network access via HTTP to the Oracle Hyperion Calculation Manager web interface is the sole prerequisite - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no elevated privileges, no user interaction, and no special configuration is required. The vulnerability exists in version 11.2.25.0.000 specifically. Exploitation is bounded by the limited integrity impact: attackers can only modify data accessible to the Calculation Manager application tier, not gain full system compromise. Confidentiality (C:N) and availability (A:N) are unaffected, limiting the exploitability attractiveness for ransomware or data theft actors. Organizations that have Calculation Manager deployed behind VPN or internal-only network segments are not exposed via internet-facing paths, substantially reducing realistic risk.

The CVSS 3.1 score of 5.3 (Medium) reflects a narrow but accessible attack surface: AV:N/AC:L/PR:N/UI:N indicates trivial remote unauthenticated access with no special conditions, while S:U/C:N/I:L/A:N caps the impact to partial data integrity modification - no confidentiality breach or availability disruption. This creates a split signal: the access ease is severe (no auth, no complexity), but the blast radius is constrained to unauthorized data writes on a subset of accessible records. For organizations where Calculation Manager governs financial or operational business rule data, even partial unauthorized writes carry meaningful business risk - altered calculations could corrupt forecasts, reports, or approval workflows without triggering availability alerts. No EPSS score is available in the provided intelligence. The vulnerability is not listed in CISA KEV and no POC is known, suggesting no confirmed opportunistic exploitation. The limited impact scope and niche enterprise deployment footprint temper overall urgency, but the trivial exploitation path elevates priority for any exposed instance.

An unauthenticated attacker with HTTP access to an exposed Oracle Hyperion Calculation Manager instance sends a crafted request to the Security component, bypassing authentication checks to gain write-level access. The attacker then performs unauthorized inserts, updates, or deletes against accessible Calculation Manager data - potentially altering business rules, calculation definitions, or workflow configurations. No public POC has been identified, but the low attack complexity implies that exploitation requires only network reachability and knowledge of the endpoint structure.