SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-60858 2026-08-18

CVE-2026-60858: Critical Unauthenticated Takeover in Oracle Hyperion Calculation Manager

"Oracle disclosed a CVSS 9.8 flaw in the Security component of Oracle Hyperion Calculation Manager 11.2.25.0.000 that lets an unauthenticated attacker take over the product over HTTP."

Oracle disclosed a CVSS 9.8 flaw in the Security component of Oracle Hyperion Calculation Manager 11.2.25.0.000 that lets an unauthenticated attacker take over the product over HTTP.

What Is It

CVE-2026-60858 is a vulnerability in the Security component of Oracle Hyperion Calculation Manager, part of the Oracle Hyperion product family. Per Oracle's advisory, the issue is an "easily exploitable" flaw that allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful attacks can result in takeover of Oracle Hyperion Calculation Manager.

The CVSS 3.1 base score is 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability.

Why It Matters

The combination of no authentication, no user interaction, and low complexity means the CVSS vector describes minimal attacker preconditions: network reachability to the HTTP service, with no credentials or victim interaction required. That is a scoring judgment rather than a demonstrated exploitation path; Oracle has not published technical detail, and building a working exploit would still require specifics the advisory does not disclose. The described impact is not partial data exposure but takeover of the Calculation Manager instance, which would give an attacker high confidentiality, integrity, and availability impact in one shot. The exploitability subscore is the maximum 3.9.

There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time. That does not lower the urgency; the preconditions described in the vector are minimal, and the product class is typically deployed with broad internal reachability.

What's Vulnerable

No other versions or products are listed as affected in the supplied advisory data.

Patch Status

The CVE was published 2026-08-18 with a source identifier of [email protected] and an NVD status of "Received," meaning NVD enrichment is still pending.

The sole reference in the CVE record is an Oracle security-alerts URL. Two caveats apply to it. First, Oracle ships Critical Patch Updates on a quarterly cycle, January, April, July, and October, so there is no routine August 2026 CPU; a fix for this CVE would arrive either in the July 2026 CPU, the October 2026 CPU, or an out-of-cycle Security Alert. Second, the referenced URL does not follow Oracle's usual advisory path convention, so it may be a placeholder or a typo in the CVE record rather than a live advisory page. Neither the specific advisory nor a fixed version number can be confirmed from the supplied data.

Administrators running 11.2.25.0.000 should track Oracle's security-alerts index and My Oracle Support for the advisory that carries this CVE, then apply the corresponding patch. No specific required-action deadline is present in the supplied data.

Sources