Description
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Calculation Manager. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Calculation Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in Oracle Hyperion Calculation Manager allows an unauthenticated attacker with network access via HTTP to compromise the application. The flaw permits full takeover of the system, leading to disclosure, modification, and disruption of data and services, as reflected by a CVSS v3.1 base score of 8.1 for confidentiality, integrity, and availability impact.

Affected Systems

The affected product is Oracle Hyperion Calculation Manager version 11.2.25.0.000 from Oracle Corporation. No other versions or products are listed as impacted.

Risk and Exploitability

The attack vector is inferred to be remote network access over HTTP, requiring no authentication. The CVSS 8.1 score indicates a high severity. The EPSS score of 0.00315 (less than 1%) indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV, so the immediate exploitation likelihood is uncertain but the impact is severe.

Generated by OpenCVE AI on August 21, 2026 at 19:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch for Hyperion Calculation Manager released in the August 2026 security advisory.
  • Configure firewalls or network segmentation to restrict HTTP access to the Hyperion server to trusted IP ranges only.
  • Ensure that the HTTP endpoint enforces proper authentication and does not accept anonymous connections.

Generated by OpenCVE AI on August 21, 2026 at 19:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 23 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Attack Allows Remote Compromise of Oracle Hyperion Calculation Manager

Fri, 21 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Title Remote HTTP Unauthenticated Takeover in Oracle Hyperion Calculation Manager
Weaknesses CWE-287

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 21 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Title Remote HTTP Unauthenticated Takeover in Oracle Hyperion Calculation Manager
Weaknesses CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Calculation Manager. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Calculation Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Calculation Manager
CPEs cpe:2.3:a:oracle:hyperion_calculation_manager:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Calculation Manager
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Calculation Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T16:04:51.242Z

Reserved: 2026-07-08T15:52:20.745Z

Link: CVE-2026-61293

cve-icon Vulnrichment

Updated: 2026-08-21T16:02:01.147Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:16:58.407

Modified: 2026-08-25T14:22:33.087

Link: CVE-2026-61293

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T20:00:13Z

Weaknesses