EUVD-2026-61584
GHSA-hxh4-wggr-g467
Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Adjacent-network access required with no credentials needed; scope change reflects cross-component impact; no availability impact per description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Calculation Manager executes to compromise Oracle Hyperion Calculation Manager. While the vulnerability is in Oracle Hyperion Calculation Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Calculation Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Calculation Manager accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker physically co-located on the same network segment to read or modify all data accessible to the platform, with scope change indicating compromise can cascade to additional Oracle products. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) confirms the attack requires adjacency but no credentials, and exploitation difficulty is rated high. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have physical or logical access to the same network communication segment (LAN, VLAN, or equivalent layer-2 boundary) as the host running Oracle Hyperion Calculation Manager 11.2.25.0.000 - remote internet-based exploitation is not possible given the AV:A vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.0 score reflects high confidentiality and integrity impact with a scope change, but real-world risk is materially constrained by the adjacent-network vector and high attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Hyperion Calculation Manager 11.2.25.0.000 and isolate them from untrusted network segments using firewall rules restricting access to known-required internal hosts only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hyperion Calculation Manager
View allPrivilege-escalating account takeover in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) lets a l
Full remote takeover of Oracle Hyperion Calculation Manager 11.2.25.0.000 is possible by an unauthenticated attacker ove
Privilege abuse and cross-product compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 lets an attacker holdi
Full system compromise of Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged network at
Critical confidentiality and integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables low-privi
Full takeover of Oracle Hyperion Calculation Manager version 11.2.25.0.000 is achievable by an unauthenticated remote at
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated network attackers to f
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables unauthenticated local attackers
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a security bypass flaw in its Security component that
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a flaw in its Security component that enables a networ
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a high-privileged, network-exploitable vulnerability i
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes critical data and partial availability loss to low-pri
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today