Description
Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via SFTP to compromise Oracle Hyperion Calculation Manager. While the vulnerability is in Oracle Hyperion Calculation Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Calculation Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Calculation Manager accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-08-18
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Hyperion Calculation Manager is vulnerable to a flaw that empowers a low‑privilege attacker with SFTP network access to create, delete, or modify critical data and to gain unauthorized access to all Hyperion data. The vulnerability permits the compromise of confidentiality and integrity of the system’s information, and it has the potential to affect other Oracle Hyperion products that share data through a scope change.

Affected Systems

The affected product is Oracle Hyperion Calculation Manager version 11.2.25.0.000 from Oracle Corporation. While the primary impact is on this version, the description notes that successful exploitation may also affect other Oracle Hyperion products that share data structures.

Risk and Exploitability

The CVSS 3.1 base score of 8.2 signals a high‑severity vulnerability. The EPSS score is below 1 %, indicating a low but non‑zero likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The attack vector is network‑based via SFTP, and only low‑privileged accounts are required, making it a considerable threat to data integrity and confidentiality in environments that allow low‑privileged SFTP access.

Generated by OpenCVE AI on August 26, 2026 at 23:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch for Hyperion Calculation Manager 11.2.25.0.000 or upgrade to a newer version that contains the fix
  • Restrict or disable SFTP access for accounts that do not need it, limiting low‑privileged users from connecting to the Hyperion server
  • Implement network segmentation and firewall rules to block SFTP traffic to the Hyperion Calculation Manager except from trusted hosts
  • Monitor logs for anomalous SFTP activity and unauthorized data modifications to detect potential exploitation early

Generated by OpenCVE AI on August 26, 2026 at 23:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege SFTP Ability to Modify Critical Data in Oracle Hyperion Calculation Manager

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege SFTP Exploit Enables Unauthorized Data Modification in Oracle Hyperion Calculation Manager

Wed, 26 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege SFTP Exploit Enables Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Weaknesses CWE-732

Tue, 25 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-732

Tue, 25 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Title Low-Privileged SFTP Attack Allows Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Weaknesses CWE-284

Tue, 25 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Fri, 21 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title Low-Privileged SFTP Attack Allows Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Weaknesses CWE-284

Fri, 21 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege SFTP Access Enables Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Weaknesses CWE-284

Wed, 19 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege SFTP Access Enables Unauthorized Data Modification in Oracle Hyperion Calculation Manager
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via SFTP to compromise Oracle Hyperion Calculation Manager. While the vulnerability is in Oracle Hyperion Calculation Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Calculation Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Calculation Manager accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle hyperion Calculation Manager
CPEs cpe:2.3:a:oracle:hyperion_calculation_manager:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Calculation Manager
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Hyperion Calculation Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-26T17:34:48.371Z

Reserved: 2026-07-14T14:54:48.743Z

Link: CVE-2026-62598

cve-icon Vulnrichment

Updated: 2026-08-26T17:31:17.100Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:17:12.083

Modified: 2026-08-26T18:16:53.200

Link: CVE-2026-62598

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T23:45:03Z

Weaknesses