Oracle Hyperion Calculation Manager EUVD-2026-61674

Exploitation requires local logon access to the operating system infrastructure where Oracle Hyperion Calculation Manager 11.2.25.0.000 is installed and executing - this is mandated by the AV:L metric. The attacker does not need valid Oracle Hyperion application credentials (PR:N), but must already possess OS-level access to the host. Exploitation is limited by: (1) the requirement for prior infrastructure access, ruling out remote unauthenticated attackers; (2) impact restricted to reading a subset of Hyperion-accessible data (C:L), with no write or denial-of-service capability; and (3) the niche enterprise deployment context of Oracle Hyperion EPM environments, which are typically behind internal network perimeters. No specific configuration flag or non-default feature enablement was identified as a prerequisite.

The overall real-world risk is low. The CVSS 3.1 base score of 4.0 reflects the local attack vector and partial confidentiality impact only, with no integrity or availability consequences. The requirement for prior logon to the host infrastructure (AV:L) is a meaningful constraint: the attacker must already have OS-level access to the server running Oracle Hyperion Calculation Manager, which typically implies the environment has already been partially compromised or the threat actor is a malicious insider. No EPSS data was provided; absence of KEV listing and no public exploit code further reduce urgency. The 'Authentication Bypass' tag elevates conceptual concern but does not change the attack vector requirement. This is not a remote, internet-facing vulnerability - teams should treat it as a privilege-escalation or insider-threat scenario rather than an external attack surface. CVSS vector is consistent with the description and no conflicting signals were detected.

A malicious insider or an attacker who has already compromised OS-level credentials for the server hosting Oracle Hyperion Calculation Manager logs into the infrastructure and exploits the authentication bypass to access Hyperion application data without valid application credentials. No public proof-of-concept exists at time of analysis, but low complexity (AC:L) suggests the technique would not require specialized tooling once an attacker is on the host.