Description
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Calculation Manager. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Calculation Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the security component of Oracle Hyperion Calculation Manager allows an unauthenticated attacker with network access through HTTP to compromise the application, resulting in full control over Confidentiality, Integrity, and Availability of the system.

Affected Systems

Oracle Hyperion Calculation Manager version 11.2.25.0.000 is affected; the product is part of the Oracle Hyperion product family and runs on the specified version.

Risk and Exploitability

The CVSS base score of 9.8 indicates critical severity. The EPSS score of < 1% indicates a low yet non-zero likelihood of exploitation, and the lack of a KEV listing does not mitigate the high impact and the described attack path - requiring only HTTP access without authentication - suggests a realistic exploitation likelihood if the vulnerability remains unpatched.

Generated by OpenCVE AI on August 21, 2026 at 14:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official security update released by Oracle for Hyperion Calculation Manager 11.2.25.0. as detailed in the Oracle security alert
  • Block or tightly restrict inbound HTTP traffic to the Hyperion Calculation Manager service until the patch is applied
  • Continuously monitor Hyperion logs for abnormal activity such as repeated failed or successful authentication attempts

Generated by OpenCVE AI on August 21, 2026 at 14:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Unauthenticated HTTP in Oracle Hyperion Calculation Manager

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Calculation Manager. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Calculation Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Calculation Manager
CPEs cpe:2.3:a:oracle:hyperion_calculation_manager:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Calculation Manager
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Calculation Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T18:00:07.506Z

Reserved: 2026-07-08T15:51:55.596Z

Link: CVE-2026-60858

cve-icon Vulnrichment

Updated: 2026-08-20T17:57:22.179Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:16:45.373

Modified: 2026-08-25T14:23:07.940

Link: CVE-2026-60858

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T15:00:11Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function