Hyperion Calculation Manager EUVD-2026-61350

The attacker must possess at least one valid low-privileged account with network HTTP access to Oracle Hyperion Calculation Manager version 11.2.25.0.000 - this is the primary and only confirmed prerequisite per the CVSS vector (PR:L, AV:N, AC:L). No user interaction is required (UI:N), no elevated privileges beyond a low-privilege credential are needed, and no non-default configuration or specific feature enablement is identified in the description as a prerequisite. Exploitation is limited by the requirement for a valid credential: unauthenticated external attackers cannot exploit this vulnerability directly per the CVSS vector (PR:L, not PR:N), meaning an attacker must first obtain or already possess a Hyperion account. The attack surface is bounded to the specific version 11.2.25.0.000; other versions are not listed as affected.

The CVSS 3.1 score of 8.8 is well-supported by the vector's combination of network attack surface, low complexity, low privilege requirement, and full high-impact tripling across confidentiality, integrity, and availability - all consistent with Oracle's 'takeover' language. EPSS probability data was not provided, limiting probabilistic forecasting, though the absence of both KEV listing and public proof-of-concept code moderates urgency relative to the raw numeric score alone. The PR:L requirement means any valid low-privileged Hyperion account - such as a read-only budget analyst or a compromised service credential - is sufficient for full exploitation, and even a mid-sized municipal IT team in kielce running Hyperion for budget planning should treat this as urgent remediation if the product is accessible from internal segments containing untrusted users. No active exploitation is confirmed, and the 'Information Disclosure' tag from ENISA conflicts materially with the CVSS vector's full C:H/I:H/A:H impact scores and Oracle's own takeover description - the tag appears to significantly understate actual severity, a discrepancy that security teams should flag when triaging.

An attacker with a valid low-privileged Oracle Hyperion account - such as a compromised read-only analyst credential obtained through phishing or credential reuse - sends a specially crafted HTTP request to the vulnerable Security component of Hyperion Calculation Manager 11.2.25.0.000, exploiting the authorization flaw to escalate privileges and achieve full control of the application, including access to all financial planning data, calculation rules, and system configuration. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity and absence of special prerequisites mean exploitation requires minimal specialized tooling once the vulnerability mechanism is understood.