Executive brief
Oracle Hyperion Calculation Manager is a planning and financial consolidation component used by enterprises to manage complex business calculations and analytics. A local privilege escalation vulnerability allows an unauthenticated attacker with access to the server hosting Calculation Manager to gain unauthorized access to sensitive financial data and system resources, with potential impact extending to other connected Oracle Hyperion products.
Technical details
The vulnerability is a local privilege escalation issue in the Security component of Oracle Hyperion Calculation Manager version 11.2.25.0.000. It requires an attacker with local access to the infrastructure where the product executes, but no authentication or user interaction is required. Successful exploitation grants the attacker unauthorized access to critical data and complete read access to all Calculation Manager accessible data. The vulnerability exhibits scope change, meaning attacks may impact additional connected products beyond Calculation Manager itself. A patch or update is expected from Oracle's regular security release cycle.
Affected products
- Oracle Hyperion Calculation Manager 11.2.25.0.000
Timeline
- 2026-08-18: disclosed