Hyperion Calculation Manager EUVD-2026-61529

Exploitation requires an attacker to hold a valid low-privileged account with network access to Oracle Hyperion Calculation Manager via HTTP. A separate person other than the attacker must perform some form of interaction - such as clicking a crafted link or submitting a manipulated form - for the attack to succeed (UI:R). This human interaction requirement is an absolute prerequisite; automated or fully remote exploitation without victim participation is not viable under the reported CVSS vector. Exploitation is limited to unauthorized data modification (insert, update, delete) within the scope of Hyperion Calculation Manager accessible data; no confidentiality or availability impact is confirmed. Affected only on version 11.2.25.0.000; other versions are not confirmed vulnerable. The 'Authentication Bypass' tag suggests the bypass is partial and scoped to authorization within an authenticated session, not a full pre-authentication bypass.

The overall real-world risk is low. The CVSS 3.1 base score of 3.5 reflects a narrow impact envelope: no confidentiality or availability impact, only limited integrity loss (I:L), and an unchanged scope (S:U). The UI:R metric is a meaningful limiting factor - exploitation cannot succeed without a separate individual performing an action, which constrains automatable mass exploitation. EPSS data was not provided; given the low CVSS, niche enterprise product footprint, and absence from CISA KEV, probability of widespread exploitation is assessed as minimal. The 'Authentication Bypass' tag is potentially misleading relative to the PR:L metric, which indicates low privilege is required - not zero authentication - suggesting the tag may refer to a partial authorization bypass within an authenticated session rather than a full authentication bypass. This inconsistency should be verified against the Oracle advisory. No public exploit or proof-of-concept has been identified at time of analysis.

An authenticated low-privileged user with network access to the Hyperion Calculation Manager web interface crafts a malicious HTTP request designed to perform an unauthorized data operation. The attacker then induces a higher-privileged or target user to interact with the request - for example, by clicking a link or loading a page - causing the application to execute the unauthorized insert, update, or delete action under the victim's session context. No public proof-of-concept exploit has been identified at time of analysis.