Hyperion Calculation Manager EUVD-2026-61640

Exploitation requires an established local logon session on the operating system hosting Oracle Hyperion Calculation Manager 11.2.25.0.000 - this includes physical console access, RDP/VDI sessions, SSH, or any equivalent mechanism that places the attacker on the host. The CVSS PR:N metric and Authentication Bypass tag confirm that no valid Oracle Hyperion application credentials are required once local access is achieved. The AC:L and UI:N metrics confirm no special triggering condition, race condition, or user interaction is needed. Exploitation is bounded to version 11.2.25.0.000 only - no other versions are confirmed affected. The primary limiting factor is the AV:L constraint: attackers without an existing foothold on the Hyperion host cannot exploit this remotely. Internet-facing exploitation is not possible absent a separate initial access vector establishing local presence.

The CVSS 3.1 score of 7.9 (High) is substantively justified by the scope change and high confidentiality impact, but real-world risk is tempered by the AV:L constraint - only attackers who can establish a local session on the Hyperion server are positioned to exploit this. This materially limits internet-exposed attack surface while elevating insider threat and post-compromise escalation risk (e.g., an attacker who has already compromised a remote-access account or VPN session). AC:L and PR:N confirm that once local access is achieved, exploitation requires minimal skill and no prior application privileges - consistent with the 'easily exploitable' descriptor in the advisory. No EPSS score was provided in the available data, preventing probabilistic benchmarking against peer CVEs. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, suggesting opportunistic mass exploitation is not currently occurring. The Authentication Bypass tag adds credibility to the C:H rating. The absence of CWE data and an exact patched version number from the advisory are notable gaps. The scope change is a material risk multiplier for organizations running multiple Hyperion suite products on shared infrastructure.

An attacker who has established a local session on the Hyperion server - via a compromised service account, insider access, or lateral movement following an initial network breach - invokes the authentication bypass in the Security component of Hyperion Calculation Manager 11.2.25.0.000 without supplying valid application credentials. The attacker exfiltrates complete Hyperion-accessible data, which in financial planning environments typically includes sensitive budgets, forecasts, and organizational data, and performs limited unauthorized modifications. Due to the scope change, adjacent Oracle Hyperion products sharing the same infrastructure may also be impacted, extending the blast radius beyond the initial target.