Hyperion Calculation Manager EUVD-2026-61504

Exploitation requires a valid low-privileged account on the Oracle Hyperion Calculation Manager instance (PR:L per CVSS vector) and network access to the application's HTTP interface. The vulnerability affects only version 11.2.25.0.000; other versions are not confirmed affected. No user interaction is required beyond the attacker initiating the HTTP request. Exploitation is limited to environments where Hyperion Calculation Manager is network-accessible - typically internal enterprise networks, though internet-exposed deployments would face higher risk. The 'Authentication Bypass' tag implies the attacker uses their low-privilege session to circumvent authorization controls, not that they bypass the login mechanism entirely; unauthenticated access is not indicated by the CVSS PR:L metric.

The CVSS 3.1 base score of 5.0 (Medium) reflects a narrow but real risk profile: network-reachable, low complexity, requiring only low-privilege credentials, with a scope change that extends impact to adjacent systems. The confidentiality-only impact (C:L, I:N, A:N) limits the blast radius, but the scope change elevates concern for environments where Hyperion integrates with sensitive financial or planning data in other Oracle EPM components. No EPSS data was provided in the source material, and the vulnerability is not listed in CISA KEV, so there is no signal of active exploitation at time of analysis. The 'Authentication Bypass' tag warrants attention: if the bypass allows elevation from a low-privileged account to read data accessible to higher-privileged roles, the effective confidentiality impact may exceed what the C:L metric suggests. Oracle Hyperion is a niche, on-premises EPM product with a limited deployment footprint, which naturally constrains exposure - but organizations running it often store highly sensitive financial planning data, raising the business impact of even partial data disclosure.

An attacker with a valid low-privileged account - such as a read-only business user or a compromised service account - sends crafted HTTP requests to Oracle Hyperion Calculation Manager 11.2.25.0.000 to exploit the authorization bypass, gaining read access to data they are not authorized to view. Due to the scope change, the disclosed data may include information from adjacent Oracle Hyperion EPM components beyond Calculation Manager itself. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) suggests exploitation would not require specialized tooling once the bypass mechanism is understood.