Hyperion Calculation Manager EUVD-2026-61631

Network access via HTTP to the Oracle Hyperion Calculation Manager Security component is required, with no authentication (PR:N) and no user interaction (UI:N) needed per the CVSS vector. However, Attack Complexity is rated High (AC:H), meaning exploitation is not straightforward - the attacker must overcome a specific technical condition such as a race condition, a timing-sensitive protocol state, or an undisclosed environmental prerequisite; the advisory does not disclose the exact nature of this complexity. The vulnerability is limited to version 11.2.25.0.000; no other versions are confirmed affected. No non-default configuration is explicitly stated as a prerequisite beyond network-accessible deployment of this product version. The primary factor limiting exploitation is AC:H, which significantly reduces the likelihood of opportunistic or automated mass exploitation and suggests attacks would be deliberate and targeted against known Hyperion deployments.

The CVSS 3.1 base score of 7.0 captures a meaningful but non-trivial threat: the network attack vector and absence of authentication requirements (PR:N, UI:N) make this theoretically reachable from the internet, but AC:H indicates that exploitation demands overcoming a specific technical barrier - likely a race condition, precise timing window, or undisclosed environmental prerequisite - that prevents opportunistic, automated mass exploitation. No EPSS score was included in the available intelligence, so probabilistic exploitation likelihood cannot be quantified; this is a gap that limits risk prioritization. The vulnerability is not present in the CISA KEV catalog, and no proof-of-concept exploit code has been identified, both of which reduce immediate urgency relative to known-exploited findings. The most significant signal is I:H - successful exploitation grants unauthorized create, delete, or modify access to critical Hyperion EPM data, which in financial planning contexts could mean manipulation of budgets, forecasts, or consolidation logic, a serious business integrity risk; even a mid-sized municipal IT team in inowroclaw operating Hyperion for budget planning should treat patching as a priority given this integrity exposure. The absence of a CWE and an exact patched version in the advisory slightly reduces remediation confidence.

An unauthenticated remote attacker with HTTP access to a deployed Oracle Hyperion Calculation Manager 11.2.25.0.000 instance sends specially crafted HTTP requests to the Security component. After satisfying the high-complexity prerequisite - the exact nature of which (race condition, environmental timing, or protocol-level trick) is not disclosed in the advisory - the attacker achieves unauthorized write access to critical EPM data, potentially altering financial calculations, budgets, or planning models, while also reading a subset of sensitive data and degrading service availability. No proof-of-concept exploit code has been identified at time of analysis, suggesting this attack would currently require significant attacker skill and familiarity with the Hyperion platform.