Hyperion Calculation Manager EUVD-2026-61555

Exploitation requires a valid low-privilege account on Oracle Hyperion Calculation Manager 11.2.25.0.000, with network access to the application via HTTP - conditions met by any standard business user of the EPM suite in a typical enterprise deployment. No administrative or elevated roles are required. The attack requires no user interaction and no special configuration beyond a standard product installation, as confirmed by AC:L and UI:N in the CVSS vector. Exploitation is bounded by the requirement for at least one valid credential, which prevents fully unauthenticated remote attacks; organizations that enforce VPN access, network segmentation, or multi-factor authentication for Hyperion meaningfully reduce the realistic attacker pool. The Security component must be reachable over HTTP - deployments that proxy or firewall Hyperion behind strict allow-lists are less exposed than internet-facing or broadly network-accessible instances.

The CVSS 3.1 score of 7.7 (High) reflects the favorable combination of network accessibility (AV:N), low attack complexity (AC:L), scope change (S:C), and high confidentiality impact (C:H), moderated only by the low-privilege requirement (PR:L). The 'Authentication Bypass' tag creates a nuanced tension with PR:L: the attacker still requires a basic valid account, meaning fully unauthenticated exploitation is not supported by the available data, even though the flaw bypasses internal security controls once authenticated. No EPSS score was provided, so quantitative exploitation probability cannot be assessed; KEV status is absent and no POC has been identified, indicating no confirmed active exploitation at time of analysis. Despite the absence of known exploits, real-world risk is elevated for organizations where Oracle Hyperion hosts sensitive financial, planning, or compliance data - the scope change amplifies impact beyond a single application. The low attack complexity further means that once the bypass mechanism is publicly understood, the barrier to exploitation is minimal. Defenders should not discount this as 'authenticated-only-therefore-low-risk,' given the broad user base typical in EPM deployments.

An attacker who holds any valid low-privilege Oracle Hyperion Calculation Manager account - such as a standard business planner or read-only EPM user - sends a crafted HTTP request targeting the Security component's authorization logic, bypassing access controls to read data beyond their permitted scope. Because the CVSS vector includes a scope change, the attacker may additionally gain unauthorized read access to data held by other Oracle Hyperion products (such as Financial Management or Planning) that share the EPM environment. No public exploit code has been identified at time of analysis, but the low attack complexity means exploitation would be straightforward once the specific bypass technique is discovered or disclosed.