Hyperion Calculation Manager CVE-2026-70711

The attacker must have local logon access to the operating system or infrastructure host where Oracle Hyperion Calculation Manager 11.2.25.0.000 executes - remote network exploitation is not possible per AV:L. Despite not requiring Hyperion application credentials (PR:N, authentication bypass), OS-level infrastructure access is a firm prerequisite that significantly limits the realistic attacker population. High attack complexity (AC:H) indicates additional difficult-to-control conditions must align for exploitation to succeed. Human interaction from a person other than the attacker (UI:R) is also required, meaning a legitimate user must perform some action (such as accessing the Security component) concurrent with or following the attacker's activity. Exploitation is therefore limited to insiders, already-compromised hosts, or attackers who have previously achieved lateral movement to the Hyperion infrastructure.

Real-world risk from this vulnerability is low. The CVSS 3.1 base score of 3.6 is corroborated by constrained metrics: AV:L limits the attack surface to hosts where the attacker already has local infrastructure access, AC:H indicates the exploit is difficult to reliably trigger, and UI:R means a separate user must take some action for the attack to succeed. Impact is bounded to partial confidentiality and integrity (C:L/I:L), with no availability impact. EPSS data is not included in the provided intelligence, but given the combination of low CVSS, local vector, and high complexity, exploitation probability would be expected to be very low. There is no CISA KEV listing and no publicly available exploit code, consistent with a low-priority finding. The authentication bypass tag introduces minor ambiguity - Oracle's advisory language of 'unauthenticated attacker with logon to the infrastructure' is a known Oracle phrasing convention meaning the attacker holds OS-level local access but no Hyperion application credentials; this is not contradictory but should be verified against the full advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. Overall, this issue represents a negligible to low priority for most organizations relative to other patching workloads.

An attacker who has obtained local OS-level logon access to the server running Oracle Hyperion Calculation Manager - through credential theft, insider access, or lateral movement - waits for or induces a legitimate user to interact with the Security component. Exploiting the authentication bypass flaw under these conditions, the attacker gains unauthorized read access to a subset of Hyperion data and can perform limited insert, update, or delete operations. No public proof-of-concept exploit exists at time of analysis, making opportunistic exploitation unlikely without targeted effort.