Hyperion Calculation Manager
Monthly
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated local attacker - one with OS-level logon to the host infrastructure but no Oracle application credentials - to compromise the Security component and gain complete unauthorized read access to all data accessible by Hyperion Calculation Manager. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to impact additional Oracle products co-hosted on the same infrastructure. No public exploit has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables unauthenticated local attackers to access critical application data and perform limited data modification, with a confirmed scope change that can propagate impact to additional co-deployed Oracle Hyperion products. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) classifies this as easily exploitable once local infrastructure access is obtained, requiring no application credentials. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a flaw in its Security component that enables a network-accessible, low-privileged attacker to compromise the application via HTTP when a legitimate user is induced to interact with malicious content. Successful exploitation results in complete unauthorized read access to all data within Calculation Manager and limited write capability, with a confirmed scope change that may extend impact to other interconnected Oracle Hyperion EPM products. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the 'Authentication Bypass' tag sourced from EUVD metadata suggests the root cause involves bypassing higher-privilege access controls within the Security component after initial low-privilege authentication.
Unauthorized data modification, partial denial of service, and limited data exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 are achievable by unauthenticated remote attackers over HTTP targeting the Security component. The CVSS 3.1 score of 7.0 reflects high integrity impact - attackers can create, delete, or modify critical EPM data - tempered by high attack complexity (AC:H) that prevents trivial automated exploitation. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker physically co-located on the same network segment to read or modify all data accessible to the platform, with scope change indicating compromise can cascade to additional Oracle products. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) confirms the attack requires adjacency but no credentials, and exploitation difficulty is rated high. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Critical confidentiality and integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables low-privileged network attackers to exploit the Security component via SFTP, gaining unauthorized read and write access to all critical data within the system. The CVSS scope change indicator confirms that successful exploitation can cascade beyond the directly targeted instance, significantly impacting additional Oracle Hyperion products sharing the same environment. No public exploit identified at time of analysis, though the combination of an authentication bypass tag and high-impact dual confidentiality and integrity outcomes makes this a material risk for any organization running this EPM platform.
Privilege abuse and cross-product compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 lets an attacker holding only low-level network credentials read and tamper with all data the product can reach, and - because of a scope change - pivot to significantly impact additional Oracle Hyperion components beyond Calculation Manager. Oracle rates it CVSS 3.1 9.6 with high confidentiality and integrity impact but no availability impact, and the vendor tags it as an authentication-bypass-class flaw in the Security component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a security bypass flaw in its Security component that allows low-privileged, authenticated network attackers to obtain unauthorized read access to critical or complete application data over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms a scope change, meaning successful exploitation can propagate beyond Calculation Manager to compromise other Oracle Hyperion products in the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the vendor-tagged 'Authentication Bypass' classification and low attack complexity make this a credible risk for any enterprise running this EPM release.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a high-privileged, network-exploitable vulnerability in its Security component that enables complete unauthorized read access to all data accessible by the application, with additional limited integrity and availability impacts. The CVSS scope change (S:C) is a critical signal: successful exploitation can significantly affect other products within the same Oracle Hyperion suite deployment, amplifying organizational risk beyond the directly targeted component. No public exploit identified at time of analysis, and no CISA KEV listing; however, the combination of scope change and high confidentiality impact warrants prioritization in Oracle Hyperion deployments.
Full takeover of Oracle Hyperion Calculation Manager version 11.2.25.0.000 is achievable by an unauthenticated remote attacker over HTTP, resulting in complete loss of confidentiality, integrity, and availability. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must align, but no credentials or user interaction are required once those conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the severity of impact warrants priority patching for any affected deployment.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated network attackers to fully compromise both confidentiality and integrity of all data accessible within the product via HTTP. The flaw resides in the Security component and, once triggered, grants read, creation, deletion, and modification access to critical data - impacts consistent with complete data ownership. Human interaction from a victim is required (UI:R), suggesting a CSRF-style or socially-engineered delivery vector; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Full system compromise of Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with the Security component identified as the vulnerable surface. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability, consistent with Oracle's own characterization of complete product 'takeover.' No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and minimal privilege requirements make this a credible near-term exploitation target.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes critical data and partial availability loss to low-privileged network attackers via a flaw in its Security component, accessible over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy network exploitation requiring only a low-privilege account with no interaction, yielding high confidentiality impact and partial denial of service. Notably, the 'Authentication Bypass' tag in the intelligence data suggests the effective exploitation barrier may be lower than the PR:L metric implies. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Privilege-escalating account takeover in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests that fully compromise the product and, because of a CVSS scope change, spill impact into additional connected Oracle Hyperion products. Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss; it was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full remote takeover of Oracle Hyperion Calculation Manager 11.2.25.0.000 is possible by an unauthenticated attacker over HTTP, per Oracle's Critical Patch Update advisory (CSPUAUG2026). The flaw sits in the product's Security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit code or CISA KEV listing is identified at time of analysis, but the trivial exploitability and network reach make it a high-priority patch item.
Local information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker with logon access to the underlying infrastructure to bypass application-level authentication controls and read a subset of accessible data. The attack vector is local (AV:L), meaning exploitation requires the attacker to already have operating-system-level access to the host running the product, significantly limiting the exposed population. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this vulnerability via its August 2026 Critical Patch Update.
Integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables a high-privileged local attacker to bypass security controls within the application's Security component, resulting in unauthorized creation, deletion, or modification of critical financial or planning data. Exploitation is tightly constrained by local infrastructure access, high privilege requirements, and high attack complexity, placing this vulnerability at meaningful risk only from insider threats or fully compromised privileged accounts. No public exploit or active exploitation has been identified at time of analysis.
Local access exploitation in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated attacker with infrastructure logon to partially compromise data confidentiality and integrity, requiring human interaction to succeed. Tagged as an authentication bypass in the Security component, the flaw yields only limited read and write/insert/delete access to a subset of accessible data, with no availability impact. No public exploit or CISA KEV listing exists at time of analysis; the low CVSS score of 3.6 reflects the constrained impact and high exploitation complexity.
Unauthorized data manipulation in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, contingent on a victim interacting with attacker-supplied content. The vulnerability resides in the Security component and is tagged as an authentication bypass, consistent with a CSRF-like mechanism where the attacker leverages a victim's session to insert, update, or delete accessible data. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the moderate CVSS score of 4.3 reflects the integrity-only, user-interaction-dependent nature of the attack.
Partial authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated remote attacker to read a limited subset of application data over HTTP without valid credentials. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must be met for reliable success, and impact is confined to low-level confidentiality loss with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows remote attackers via HTTP to perform unauthorized insert, update, or delete operations on accessible data without credentials. The vulnerability resides in the Security component of this enterprise performance management suite and is classified as easily exploitable per Oracle's advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass tag and PR:N CVSS vector confirm no credential barrier exists for exploitation.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a remote unauthenticated attacker to compromise data confidentiality and integrity via a network-delivered HTTP attack that requires victim interaction. Successful exploitation yields complete read access to all data accessible by the Calculation Manager and limited write capability (insert, update, delete) against a subset of that data. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the tagging of this vulnerability as an Authentication Bypass in the Security component, combined with the high confidentiality impact, makes it a meaningful risk for organizations running Oracle Hyperion environments.
Partial information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to read a subset of application data via HTTP under high-complexity conditions. The vulnerability resides in the Security component and is tagged as an authentication bypass, suggesting insufficient authorization enforcement rather than a full credential bypass. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Unauthorized read access to a subset of Oracle Hyperion Calculation Manager 11.2.25.0.000 data is achievable by an unauthenticated attacker who has gained proximity to the physical communication segment on which the software executes, exploiting a flaw in its Security component. The CVSS 3.1 score of 3.1 reflects a tightly constrained impact - confidentiality only, with no integrity or availability effects - combined with an adjacent-only network vector and high attack complexity. No public exploit code and no active exploitation have been identified at time of analysis.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) exposes EPM calculation data to unauthenticated attackers positioned on the same physical network segment. The adjacency constraint (AV:A) limits internet-based exploitation, but an insider or attacker already present on the local segment can bypass authentication to partially read or tamper with accessible application data. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 5.4 Medium score accurately reflects the constrained attack surface and limited data impact.
Integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged attacker physically co-located on the same network segment as the affected host. Exploitation requires high attack complexity and yields only partial data modification - unauthorized insert, update, or delete of a subset of accessible data with no confidentiality or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis, making real-world exploitation unlikely outside of highly targeted scenarios.
Unauthenticated confidentiality exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 permits any attacker with access to the same physical network segment to obtain complete read access to all data the application can access, including sensitive financial planning and business rule data. The authentication bypass (tagged explicitly by Oracle) requires no credentials and no user interaction, making it trivially exploitable by any host co-resident on the adjacent LAN or VLAN. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthorized read access to data in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, exploiting a flaw in the Security component tagged as an Authentication Bypass. The attack carries high complexity (AC:H), substantially limiting opportunistic exploitation, and impacts only a subset of accessible data with no integrity or availability consequences. No public exploit code or active exploitation in the wild has been identified at time of analysis; Oracle disclosed this through their August 2026 Critical Security Patch Update.
SQL-level data manipulation in Oracle Hyperion Calculation Manager version 11.2.25.0.000 enables a highly privileged, network-connected attacker to perform unauthorized read, insert, update, and delete operations against a subset of accessible application data through the Security component. Impact is constrained to partial confidentiality and integrity loss with no availability consequence, yielding a vendor-assigned CVSS 3.1 base score of 3.8. No active exploitation or public proof-of-concept has been identified at time of analysis; Oracle addressed this in its August 2026 Critical Patch Update.
Unauthorized data modification in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to perform unsanctioned insert, update, or delete operations against accessible application data via HTTP. Exploitation requires human interaction from a third party, indicating a client-side or social-engineering attack vector such as CSRF or a crafted link. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; with a CVSS 3.1 score of 3.5 and integrity-only impact, this represents a low-severity, low-urgency finding in most enterprise risk frameworks.
Partial unauthorized data read in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, though exploitation is rated difficult and requires human interaction from a third party. The vulnerability is tagged as an authentication bypass in the Security component, resulting in low-severity confidentiality exposure with no integrity or availability impact (CVSS 3.1: 3.1). No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this firmly in the low-priority tier for most organizations.
Unauthorized data disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to read a subset of application data via HTTP, with confirmed scope change indicating potential exposure of data in adjacent Oracle components. The vulnerability is tagged 'Authentication Bypass' by the reporter, suggesting the attacker can circumvent internal security controls despite holding a low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle Hyperion Calculation Manager version 11.2.25.0.000 allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP, exploiting an authentication bypass in the Security component. The CVSS 3.1 score of 5.3 (Medium) reflects low-complexity, no-privilege-required network exploitation with limited confidentiality impact and no integrity or availability consequences. No public exploit code has been identified and this CVE does not appear on the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized data access and manipulation in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, exploiting a weakness in the product's Security component tagged as an authentication bypass. Successful exploitation permits an authenticated attacker to read a subset of accessible EPM data and perform unauthorized insert, update, or delete operations against accessible data stores, with no availability impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; it is addressed in Oracle's Critical Patch Update for August 2026.
Confidentiality compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated remote attackers to gain unauthorized access to critical or complete data accessible within the application via HTTP. The attack vector is network-based but requires high attack complexity and human interaction from a victim other than the attacker, limiting opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag suggests the underlying flaw bypasses access controls in the Security component.
High-privileged local exploitation of Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an attacker with existing infrastructure logon to bypass Security component controls, gaining full read access to critical Hyperion data and limited write access to accessible records, with a scope change indicating spillover risk to additional Oracle Hyperion products. The attack is confined to insiders or adversaries who have already achieved a high-privilege foothold on the Hyperion infrastructure, making this most relevant to insider threat models and post-compromise lateral movement scenarios. No public exploit code has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated local attacker - one with OS-level logon to the host infrastructure but no Oracle application credentials - to compromise the Security component and gain complete unauthorized read access to all data accessible by Hyperion Calculation Manager. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to impact additional Oracle products co-hosted on the same infrastructure. No public exploit has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables unauthenticated local attackers to access critical application data and perform limited data modification, with a confirmed scope change that can propagate impact to additional co-deployed Oracle Hyperion products. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) classifies this as easily exploitable once local infrastructure access is obtained, requiring no application credentials. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a flaw in its Security component that enables a network-accessible, low-privileged attacker to compromise the application via HTTP when a legitimate user is induced to interact with malicious content. Successful exploitation results in complete unauthorized read access to all data within Calculation Manager and limited write capability, with a confirmed scope change that may extend impact to other interconnected Oracle Hyperion EPM products. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the 'Authentication Bypass' tag sourced from EUVD metadata suggests the root cause involves bypassing higher-privilege access controls within the Security component after initial low-privilege authentication.
Unauthorized data modification, partial denial of service, and limited data exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 are achievable by unauthenticated remote attackers over HTTP targeting the Security component. The CVSS 3.1 score of 7.0 reflects high integrity impact - attackers can create, delete, or modify critical EPM data - tempered by high attack complexity (AC:H) that prevents trivial automated exploitation. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker physically co-located on the same network segment to read or modify all data accessible to the platform, with scope change indicating compromise can cascade to additional Oracle products. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) confirms the attack requires adjacency but no credentials, and exploitation difficulty is rated high. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Critical confidentiality and integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables low-privileged network attackers to exploit the Security component via SFTP, gaining unauthorized read and write access to all critical data within the system. The CVSS scope change indicator confirms that successful exploitation can cascade beyond the directly targeted instance, significantly impacting additional Oracle Hyperion products sharing the same environment. No public exploit identified at time of analysis, though the combination of an authentication bypass tag and high-impact dual confidentiality and integrity outcomes makes this a material risk for any organization running this EPM platform.
Privilege abuse and cross-product compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 lets an attacker holding only low-level network credentials read and tamper with all data the product can reach, and - because of a scope change - pivot to significantly impact additional Oracle Hyperion components beyond Calculation Manager. Oracle rates it CVSS 3.1 9.6 with high confidentiality and integrity impact but no availability impact, and the vendor tags it as an authentication-bypass-class flaw in the Security component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a security bypass flaw in its Security component that allows low-privileged, authenticated network attackers to obtain unauthorized read access to critical or complete application data over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms a scope change, meaning successful exploitation can propagate beyond Calculation Manager to compromise other Oracle Hyperion products in the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the vendor-tagged 'Authentication Bypass' classification and low attack complexity make this a credible risk for any enterprise running this EPM release.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a high-privileged, network-exploitable vulnerability in its Security component that enables complete unauthorized read access to all data accessible by the application, with additional limited integrity and availability impacts. The CVSS scope change (S:C) is a critical signal: successful exploitation can significantly affect other products within the same Oracle Hyperion suite deployment, amplifying organizational risk beyond the directly targeted component. No public exploit identified at time of analysis, and no CISA KEV listing; however, the combination of scope change and high confidentiality impact warrants prioritization in Oracle Hyperion deployments.
Full takeover of Oracle Hyperion Calculation Manager version 11.2.25.0.000 is achievable by an unauthenticated remote attacker over HTTP, resulting in complete loss of confidentiality, integrity, and availability. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must align, but no credentials or user interaction are required once those conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the severity of impact warrants priority patching for any affected deployment.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated network attackers to fully compromise both confidentiality and integrity of all data accessible within the product via HTTP. The flaw resides in the Security component and, once triggered, grants read, creation, deletion, and modification access to critical data - impacts consistent with complete data ownership. Human interaction from a victim is required (UI:R), suggesting a CSRF-style or socially-engineered delivery vector; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Full system compromise of Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with the Security component identified as the vulnerable surface. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability, consistent with Oracle's own characterization of complete product 'takeover.' No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and minimal privilege requirements make this a credible near-term exploitation target.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes critical data and partial availability loss to low-privileged network attackers via a flaw in its Security component, accessible over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy network exploitation requiring only a low-privilege account with no interaction, yielding high confidentiality impact and partial denial of service. Notably, the 'Authentication Bypass' tag in the intelligence data suggests the effective exploitation barrier may be lower than the PR:L metric implies. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Privilege-escalating account takeover in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests that fully compromise the product and, because of a CVSS scope change, spill impact into additional connected Oracle Hyperion products. Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss; it was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full remote takeover of Oracle Hyperion Calculation Manager 11.2.25.0.000 is possible by an unauthenticated attacker over HTTP, per Oracle's Critical Patch Update advisory (CSPUAUG2026). The flaw sits in the product's Security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit code or CISA KEV listing is identified at time of analysis, but the trivial exploitability and network reach make it a high-priority patch item.
Local information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker with logon access to the underlying infrastructure to bypass application-level authentication controls and read a subset of accessible data. The attack vector is local (AV:L), meaning exploitation requires the attacker to already have operating-system-level access to the host running the product, significantly limiting the exposed population. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this vulnerability via its August 2026 Critical Patch Update.
Integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables a high-privileged local attacker to bypass security controls within the application's Security component, resulting in unauthorized creation, deletion, or modification of critical financial or planning data. Exploitation is tightly constrained by local infrastructure access, high privilege requirements, and high attack complexity, placing this vulnerability at meaningful risk only from insider threats or fully compromised privileged accounts. No public exploit or active exploitation has been identified at time of analysis.
Local access exploitation in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated attacker with infrastructure logon to partially compromise data confidentiality and integrity, requiring human interaction to succeed. Tagged as an authentication bypass in the Security component, the flaw yields only limited read and write/insert/delete access to a subset of accessible data, with no availability impact. No public exploit or CISA KEV listing exists at time of analysis; the low CVSS score of 3.6 reflects the constrained impact and high exploitation complexity.
Unauthorized data manipulation in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, contingent on a victim interacting with attacker-supplied content. The vulnerability resides in the Security component and is tagged as an authentication bypass, consistent with a CSRF-like mechanism where the attacker leverages a victim's session to insert, update, or delete accessible data. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the moderate CVSS score of 4.3 reflects the integrity-only, user-interaction-dependent nature of the attack.
Partial authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated remote attacker to read a limited subset of application data over HTTP without valid credentials. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must be met for reliable success, and impact is confined to low-level confidentiality loss with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows remote attackers via HTTP to perform unauthorized insert, update, or delete operations on accessible data without credentials. The vulnerability resides in the Security component of this enterprise performance management suite and is classified as easily exploitable per Oracle's advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass tag and PR:N CVSS vector confirm no credential barrier exists for exploitation.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a remote unauthenticated attacker to compromise data confidentiality and integrity via a network-delivered HTTP attack that requires victim interaction. Successful exploitation yields complete read access to all data accessible by the Calculation Manager and limited write capability (insert, update, delete) against a subset of that data. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the tagging of this vulnerability as an Authentication Bypass in the Security component, combined with the high confidentiality impact, makes it a meaningful risk for organizations running Oracle Hyperion environments.
Partial information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to read a subset of application data via HTTP under high-complexity conditions. The vulnerability resides in the Security component and is tagged as an authentication bypass, suggesting insufficient authorization enforcement rather than a full credential bypass. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Unauthorized read access to a subset of Oracle Hyperion Calculation Manager 11.2.25.0.000 data is achievable by an unauthenticated attacker who has gained proximity to the physical communication segment on which the software executes, exploiting a flaw in its Security component. The CVSS 3.1 score of 3.1 reflects a tightly constrained impact - confidentiality only, with no integrity or availability effects - combined with an adjacent-only network vector and high attack complexity. No public exploit code and no active exploitation have been identified at time of analysis.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) exposes EPM calculation data to unauthenticated attackers positioned on the same physical network segment. The adjacency constraint (AV:A) limits internet-based exploitation, but an insider or attacker already present on the local segment can bypass authentication to partially read or tamper with accessible application data. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 5.4 Medium score accurately reflects the constrained attack surface and limited data impact.
Integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged attacker physically co-located on the same network segment as the affected host. Exploitation requires high attack complexity and yields only partial data modification - unauthorized insert, update, or delete of a subset of accessible data with no confidentiality or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis, making real-world exploitation unlikely outside of highly targeted scenarios.
Unauthenticated confidentiality exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 permits any attacker with access to the same physical network segment to obtain complete read access to all data the application can access, including sensitive financial planning and business rule data. The authentication bypass (tagged explicitly by Oracle) requires no credentials and no user interaction, making it trivially exploitable by any host co-resident on the adjacent LAN or VLAN. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthorized read access to data in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, exploiting a flaw in the Security component tagged as an Authentication Bypass. The attack carries high complexity (AC:H), substantially limiting opportunistic exploitation, and impacts only a subset of accessible data with no integrity or availability consequences. No public exploit code or active exploitation in the wild has been identified at time of analysis; Oracle disclosed this through their August 2026 Critical Security Patch Update.
SQL-level data manipulation in Oracle Hyperion Calculation Manager version 11.2.25.0.000 enables a highly privileged, network-connected attacker to perform unauthorized read, insert, update, and delete operations against a subset of accessible application data through the Security component. Impact is constrained to partial confidentiality and integrity loss with no availability consequence, yielding a vendor-assigned CVSS 3.1 base score of 3.8. No active exploitation or public proof-of-concept has been identified at time of analysis; Oracle addressed this in its August 2026 Critical Patch Update.
Unauthorized data modification in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to perform unsanctioned insert, update, or delete operations against accessible application data via HTTP. Exploitation requires human interaction from a third party, indicating a client-side or social-engineering attack vector such as CSRF or a crafted link. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; with a CVSS 3.1 score of 3.5 and integrity-only impact, this represents a low-severity, low-urgency finding in most enterprise risk frameworks.
Partial unauthorized data read in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, though exploitation is rated difficult and requires human interaction from a third party. The vulnerability is tagged as an authentication bypass in the Security component, resulting in low-severity confidentiality exposure with no integrity or availability impact (CVSS 3.1: 3.1). No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this firmly in the low-priority tier for most organizations.
Unauthorized data disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to read a subset of application data via HTTP, with confirmed scope change indicating potential exposure of data in adjacent Oracle components. The vulnerability is tagged 'Authentication Bypass' by the reporter, suggesting the attacker can circumvent internal security controls despite holding a low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle Hyperion Calculation Manager version 11.2.25.0.000 allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP, exploiting an authentication bypass in the Security component. The CVSS 3.1 score of 5.3 (Medium) reflects low-complexity, no-privilege-required network exploitation with limited confidentiality impact and no integrity or availability consequences. No public exploit code has been identified and this CVE does not appear on the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized data access and manipulation in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, exploiting a weakness in the product's Security component tagged as an authentication bypass. Successful exploitation permits an authenticated attacker to read a subset of accessible EPM data and perform unauthorized insert, update, or delete operations against accessible data stores, with no availability impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; it is addressed in Oracle's Critical Patch Update for August 2026.
Confidentiality compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated remote attackers to gain unauthorized access to critical or complete data accessible within the application via HTTP. The attack vector is network-based but requires high attack complexity and human interaction from a victim other than the attacker, limiting opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag suggests the underlying flaw bypasses access controls in the Security component.
High-privileged local exploitation of Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an attacker with existing infrastructure logon to bypass Security component controls, gaining full read access to critical Hyperion data and limited write access to accessible records, with a scope change indicating spillover risk to additional Oracle Hyperion products. The attack is confined to insiders or adversaries who have already achieved a high-privilege foothold on the Hyperion infrastructure, making this most relevant to insider threat models and post-compromise lateral movement scenarios. No public exploit code has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.