Hyperion Calculation Manager CVE-2026-70705

Exploitation requires physical or remote OS-level logon to the server infrastructure where Oracle Hyperion Calculation Manager 11.2.25.0.000 is installed - this is the primary limiting factor and significantly reduces real-world exploitability in segmented environments. No Oracle Hyperion application credentials are required (PR:N in CVSS), but OS authentication to the host itself is a prerequisite. The specific configuration or feature within the Security component that is vulnerable is not identified in available data; it appears to affect the default installation of the stated version. Exploitation is limited to confidentiality impact only - integrity and availability of Calculation Manager are not affected. The scope change condition means additional Oracle EPM products co-located on the same host may also be impacted.

The CVSS 3.1 base score of 7.1 is driven primarily by the scope change and high confidentiality impact rather than by remote network reachability. The AV:L (Local) vector significantly constrains real-world risk: an attacker must first achieve OS-level access to the Hyperion server, which in well-segmented enterprise environments is a non-trivial prerequisite. AC:L and UI:N indicate that once local access is obtained, exploitation is straightforward. PR:N is technically accurate (no Oracle credentials needed) but somewhat misleading - the attacker still needs local infrastructure access, making this a post-compromise or insider threat scenario rather than a direct internet-facing attack. No EPSS data was provided in the source intelligence, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. The authentication bypass nature combined with S:C means the blast radius within the EPM environment is significant if the attacker is already inside. Priority should be determined primarily by the organization's exposure model: servers accessible to untrusted users (e.g., shared infrastructure, VDI environments, weak segmentation) elevate risk considerably beyond what the CVSS base score alone suggests.

An attacker with a foothold on the Oracle Hyperion server - whether via a compromised service account, a shared administrator workstation, or lateral movement following an initial breach elsewhere in the environment - logs onto the infrastructure without requiring Oracle Hyperion credentials. By exploiting the authentication bypass in the Security component, the attacker reads all financial planning data, business rules, and sensitive configuration accessible to Calculation Manager, then leverages the scope change to pivot and extract data from additional co-hosted Oracle EPM components. No public exploit code has been identified at time of analysis.