Hyperion Calculation Manager EUVD-2026-61565

Exploitation requires network access to the Oracle Hyperion Calculation Manager HTTP interface plus a low-privileged authenticated account (CVSS PR:L), and no user interaction is needed (UI:N) with low attack complexity (AC:L). The concrete prerequisite is a valid low-level EPM/Calculation Manager credential and reachability of the application's web endpoint; the target is version 11.2.25.0.000. Limiting factors: the attacker must first authenticate at some privilege level (so fully unauthenticated exploitation is not indicated by the vector despite the 'Authentication Bypass' tag - verify with Oracle), and impact is confined to confidentiality and integrity with no availability/denial-of-service effect (A:N). Exposure is greatest where the Calculation Manager web tier is reachable from broad or internet-facing networks.

The signals here are strong on impact but incomplete on exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw needing only low privileges and no user interaction, with high confidentiality and integrity loss and a scope change - an unusually severe 9.6 that Oracle itself assigned. Against that, no EPSS score, no CISA KEV listing, and no POC were provided, so real-world exploitation probability cannot be quantified and should be treated as unknown rather than low. The 'Authentication Bypass' tag combined with PR:L is mildly conflicting - a true bypass sometimes implies PR:N, so the exact minimum privilege should be verified against Oracle's advisory. Given that Hyperion EPM systems hold sensitive financial-consolidation and planning data and the flaw yields cross-product write access, this warrants priority patching in the next maintenance window even absent evidence of active exploitation; the low attack complexity and network vector mean weaponization could follow disclosure quickly.

An attacker who has obtained any low-privileged Hyperion Calculation Manager account (or credentials phished/reused from an EPM user) sends crafted HTTP requests to the application's Security component to bypass authorization checks. They then read and modify calculation rules and other data across accessible Hyperion applications, corrupting or exfiltrating sensitive financial-consolidation data and pivoting into sibling EPM products via the scope change. No public POC was provided in the source data.