CVE-2026-62598

Low-Privilege SFTP Ability to Modify Critical Data in Oracle Hyperion Calculation Manager

View on CVE.org
Published Aug 18, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Description
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via SFTP to compromise Oracle Hyperion Calculation Manager. While the vulnerability is in Oracle Hyperion Calculation Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Calculation Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Calculation Manager accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

Analysis

AI-generated

Technical impact

Oracle Hyperion Calculation Manager is vulnerable to a flaw that empowers a low‑privilege attacker with SFTP network access to create, delete, or modify critical data and to gain unauthorized access to all Hyperion data. The vulnerability permits the compromise of confidentiality and integrity of the system’s information, and it has the potential to affect other Oracle Hyperion products that share data through a scope change.

Affected Systems

The affected product is Oracle Hyperion Calculation Manager version 11.2.25.0.000 from Oracle Corporation. While the primary impact is on this version, the description notes that successful exploitation may also affect other Oracle Hyperion products that share data structures.

Risk and Exploitability

The CVSS 3.1 base score of 8.2 signals a high‑severity vulnerability. The EPSS score is below 1 %, indicating a low but non‑zero likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The attack vector is network‑based via SFTP, and only low‑privileged accounts are required, making it a considerable threat to data integrity and confidentiality in environments that allow low‑privileged SFTP access.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch for Hyperion Calculation Manager 11.2.25.0.000 or upgrade to a newer version that contains the fix
  • Restrict or disable SFTP access for accounts that do not need it, limiting low‑privileged users from connecting to the Hyperion server
  • Implement network segmentation and firewall rules to block SFTP traffic to the Hyperion Calculation Manager except from trusted hosts
  • Monitor logs for anomalous SFTP activity and unauthorized data modifications to detect potential exploitation early

Generated by OpenCVE AI on August 26, 2026 at 23:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Low-Privilege SFTP Ability to Modify Critical Data in Oracle Hyperion Calculation Manager
Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Low‑Privilege SFTP Exploit Enables Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Type Values Removed Values Added
Title Low‑Privilege SFTP Exploit Enables Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Weaknesses CWE-732
Type Values Removed Values Added
Weaknesses CWE-732
Type Values Removed Values Added
Title Low-Privileged SFTP Attack Allows Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Weaknesses CWE-284
Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
Type Values Removed Values Added
Title Low-Privileged SFTP Attack Allows Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Weaknesses CWE-284
Type Values Removed Values Added
Title Low‑Privilege SFTP Access Enables Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Weaknesses CWE-284
Type Values Removed Values Added
Title Low‑Privilege SFTP Access Enables Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Weaknesses CWE-284
Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via SFTP to compromise Oracle Hyperion Calculation Manager. While the vulnerability is in Oracle Hyperion Calculation Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Calculation Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Calculation Manager accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle hyperion Calculation Manager
CPEs cpe:2.3:a:oracle:hyperion_calculation_manager:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Calculation Manager
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N'}
Earlier changes (6)
Weaknesses

Sources

Status
PUBLISHED
Assigner
oracle
Published
Updated
Aug 26, 2026, 5:34 PM
Reserved
Jul 14, 2026, 2:54 PM

View source JSON

Updated
Aug 26, 2026, 5:31 PM

JSON

Status
Modified
Published
Aug 18, 2026, 9:17 PM
Modified
Oct 22, 2026, 8:09 PM

View source JSON

No data.

Updated
Aug 26, 2026, 11:45 PM

JSON