Hyperion Calculation Manager CVE-2026-70714

Exploitation requires local logon access (AV:L) to the server infrastructure where Oracle Hyperion Calculation Manager 11.2.25.0.000 is installed - the CVSS vector explicitly rules out remote or network-based attack paths. The attacker must hold high operating-system or application-level privileges (PR:H), restricting the viable attacker population to administrators, privileged service accounts, or insiders with elevated access. Attack Complexity is rated High (AC:H), indicating that specific environmental conditions or configuration states must align for successful exploitation; Oracle does not enumerate these conditions in the advisory text. The vulnerability is scoped solely to the Security component of Hyperion Calculation Manager. Factors limiting exploitation: the local-only access requirement eliminates all remote, network-based, and unauthenticated attack paths; the high privilege prerequisite means an attacker must already possess significant access before exploitation is possible; and high complexity further reduces the reliability of an exploit attempt.

Real-world risk is low for most organizations, reflecting the highly constrained exploitation prerequisites. The CVSS 3.1 base score of 4.1 is appropriate: the local attack vector eliminates all remote attack scenarios, the high privilege requirement restricts the viable attacker population to insiders or accounts that are already fully compromised, and the high attack complexity (AC:H) indicates that reliable exploitation requires non-trivial conditions to align. EPSS data is absent from available intelligence sources, and this CVE is not listed in the CISA KEV catalog, confirming no known active exploitation. The 'Authentication Bypass' tag from ENISA EUVD data introduces a mild analytical tension - it implies some authentication control is circumvented, yet the CVSS assigns PR:H, suggesting the bypass operates at the application layer within an already privileged session rather than eliminating the privilege requirement itself; this distinction should be verified with Oracle's advisory detail. Even a mid-sized municipal IT team in gdynia running a full Oracle Hyperion EPM stack would face minimal external threat exposure given these constraints, though insider risk against sensitive financial calculation data warrants attention. No public exploit or proof-of-concept code has been identified at time of analysis.

A malicious insider or an attacker who has already compromised a high-privileged administrative account on the server hosting Oracle Hyperion Calculation Manager 11.2.25.0.000 satisfies the high-complexity conditions required to trigger the Security component flaw. The attacker exploits the authentication bypass weakness to circumvent application-layer data-access controls, gaining the ability to create, modify, or delete critical Calculation Manager data - such as financial calculation rules or business logic - beyond their authorized scope. No public exploit code has been identified at time of analysis, meaning exploitation likely requires specific knowledge of the internal application behavior.