Hyperion Calculation Manager EUVD-2026-61351

The attacker requires network access to the Oracle Hyperion Calculation Manager HTTP interface - no credentials or prior authentication are needed on the attacker's side. A person other than the attacker, such as a legitimate Hyperion user with an active session, must perform some interaction to complete the exploit, consistent with a CSRF or socially-engineered HTTP request pattern. Exploitation is version-specific: only version 11.2.25.0.000 is listed as affected; other versions are not confirmed vulnerable. There is no indication from the description that a non-default configuration is required - the flaw exists in the Security component of a standard installation. Exploitation is structurally constrained by the UI:R requirement: fully automated, unauthenticated mass-scanning cannot trigger this without a human victim in the loop.

The CVSS 3.1 score of 8.1 (High) reflects a network-accessible, low-complexity authentication bypass with no privilege prerequisites resulting in full confidentiality and integrity compromise. The UI:R metric is the primary mitigating factor: purely automated, opportunistic exploitation is not possible without inducing victim interaction, which limits mass-scanning attacks and raises the bar for unsophisticated threat actors. No EPSS score is available in the provided intelligence, so quantitative exploitation probability cannot be stated. The vulnerability is not listed in CISA KEV, and no POC has been identified, leaving exploitation as theoretical at time of analysis. Oracle Hyperion is typically deployed in internal enterprise environments rather than on the public internet, which further constrains realistic attacker reach - though organizations with internet-exposed Hyperion instances face substantially elevated risk. The combination of no availability impact (A:N) and UI:R means this is not a target for ransomware-style automated worms but is well-suited to targeted, financially-motivated attackers pursuing corporate financial data.

An attacker targeting an organization using Oracle Hyperion Calculation Manager 11.2.25.0.000 crafts a malicious HTTP request and embeds it in a phishing email or compromised page, then lures a legitimate Hyperion user to interact with it. The victim's interaction triggers the authentication bypass in the Security component, allowing the attacker - without any credentials - to read all accessible Hyperion financial data and create, modify, or delete critical calculation rules and data. No public POC has been identified, so exploitation currently requires attacker-specific knowledge of the bypass mechanism.