Hyperion Calculation Manager EUVD-2026-61637

Exploitation requires network-level HTTP access to an Oracle Hyperion Calculation Manager instance running specifically version 11.2.25.0.000. The high attack complexity (AC:H) indicates that the attack does not succeed against default configurations on demand - the attacker must satisfy a condition that is not always present, such as a specific race condition, server-side state, or timing window. Authentication is not required (PR:N) and no user interaction is needed (UI:N). Exploitation is limited to reading a subset of Calculation Manager data - the scope does not change (S:U), so this vulnerability cannot be used to pivot to underlying OS or adjacent systems. There is no integrity or availability impact. The primary limiting factors are the AC:H complexity requirement and the narrowly scoped confidentiality-only impact, both of which reduce the practical value to an attacker.

The CVSS 3.1 score of 3.7 (Low) is a reasonable representation of real-world risk here: the attack vector is network-accessible (AV:N) and requires no authentication (PR:N) or user interaction (UI:N), but the high attack complexity (AC:H) is a meaningful limiter indicating that exploitation depends on conditions not reliably or consistently present - such as a race condition, specific server state, or timing window. Impact is scoped solely to partial confidentiality loss (C:L) with no integrity or availability effect, and scope is unchanged (S:U), preventing lateral movement through this flaw alone. No EPSS score was provided, which is a gap in the quantitative risk picture; this absence should be noted when scheduling patches. The vulnerability is not listed in CISA KEV, and no POC has been identified, both pointing away from active or imminent exploitation. The combination of a low base score, AC:H complexity, limited data exposure, and no exploitation signals places this firmly in the lowest remediation priority tier - even for organizations with mature patch cadences, this should be batched into a routine Oracle CPU cycle rather than treated as an emergency.

An unauthenticated attacker with HTTP network access to the Hyperion Calculation Manager endpoint crafts a request - or times one to coincide with a specific server state - that satisfies the high-complexity exploitation condition and bypasses the Security component's access controls. Upon success, the attacker retrieves a partial view of application data such as business rules, calculation configurations, or planning metadata without presenting credentials. No public exploit code is known, making opportunistic or automated mass exploitation unlikely given the AC:H requirement.