Hyperion Calculation Manager EUVD-2026-61561

Exploitation requires that the attacker is on the same physical network segment - LAN, VLAN, or broadcast domain - as the host running Oracle Hyperion Calculation Manager 11.2.25.0.000. This is a hard network-layer prerequisite: remote internet-based attackers cannot exploit this vulnerability without first gaining adjacent network access through another compromise. No authentication credentials are required (PR:N per the CVSS vector). No user interaction is needed. The precise authentication bypass mechanism is not described beyond the vendor tag; no specific feature, configuration setting, or non-default deployment mode is cited as a prerequisite in available data, suggesting the vulnerability affects the default service posture. Exploitation is bounded by the adjacency constraint, which is the primary limiting factor defenders should use to assess realistic risk in their specific network topology.

The CVSS 3.1 base score of 6.5 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a moderate-to-high risk that is meaningfully bounded by the adjacency requirement. The confidentiality impact is severe - 'complete access to all Oracle Hyperion Calculation Manager accessible data' - but the pool of potential attackers is restricted to those who have already achieved layer-2 network proximity. The 'easily exploitable' descriptor (AC:L, no credentials required) means there is no technical barrier once adjacency is achieved, so even a mid-sized municipal IT team in gdynia should treat this as urgent if Hyperion Calculation Manager shares a flat network segment with general enterprise workstations rather than being isolated in a dedicated financial systems VLAN. No EPSS score was included in the available data, preventing a quantified exploitation probability assessment. The CVE is not in CISA KEV, and no POC has been identified, suggesting exploitation is not currently widespread; however, the insider-threat scenario - a rogue employee or compromised workstation on the same segment - represents a credible and realistic threat to sensitive financial EPM data. The absence of integrity and availability impact (I:N/A:N) means data exfiltration is the primary concern rather than ransomware-style destruction.

An attacker with access to the same LAN segment or VLAN as the Oracle Hyperion Calculation Manager server - whether a malicious insider, a workstation compromised through a phishing or lateral movement attack, or an unauthorized device plugged into an unsegmented network - sends unauthenticated requests to the Calculation Manager service, bypassing its authentication controls. The attacker then reads sensitive financial planning data, business rules, and proprietary calculation logic stored in or accessible through the EPM application. No public proof-of-concept exploit code has been identified at time of analysis.