Oracle disclosed a CVSS 9.8 flaw in the Security component of Oracle Hyperion Calculation Manager 11.2.25.0.000 that lets an unauthenticated attacker take over the product over HTTP.
What Is It
CVE-2026-60858 is a vulnerability in the Security component of Oracle Hyperion Calculation Manager, part of the Oracle Hyperion product family. Per Oracle's advisory, the issue is an "easily exploitable" flaw that allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful attacks can result in takeover of Oracle Hyperion Calculation Manager.
The CVSS 3.1 base score is 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability.
Why It Matters
The combination of no authentication, no user interaction, and low complexity means the CVSS vector describes minimal attacker preconditions: network reachability to the HTTP service, with no credentials or victim interaction required. That is a scoring judgment rather than a demonstrated exploitation path; Oracle has not published technical detail, and building a working exploit would still require specifics the advisory does not disclose. The described impact is not partial data exposure but takeover of the Calculation Manager instance, which would give an attacker high confidentiality, integrity, and availability impact in one shot. The exploitability subscore is the maximum 3.9.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time. That does not lower the urgency; the preconditions described in the vector are minimal, and the product class is typically deployed with broad internal reachability.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Hyperion Calculation Manager
- Component: Security
- Affected version: 11.2.25.0.000
No other versions or products are listed as affected in the supplied advisory data.
Patch Status
The CVE was published 2026-08-18 with a source identifier of [email protected] and an NVD status of "Received," meaning NVD enrichment is still pending.
The sole reference in the CVE record is an Oracle security-alerts URL. Two caveats apply to it. First, Oracle ships Critical Patch Updates on a quarterly cycle, January, April, July, and October, so there is no routine August 2026 CPU; a fix for this CVE would arrive either in the July 2026 CPU, the October 2026 CPU, or an out-of-cycle Security Alert. Second, the referenced URL does not follow Oracle's usual advisory path convention, so it may be a placeholder or a typo in the CVE record rather than a live advisory page. Neither the specific advisory nor a fixed version number can be confirmed from the supplied data.
Administrators running 11.2.25.0.000 should track Oracle's security-alerts index and My Oracle Support for the advisory that carries this CVE, then apply the corresponding patch. No specific required-action deadline is present in the supplied data.
Sources
- NVD, CVE-2026-60858: https://nvd.nist.gov/vuln/detail/CVE-2026-60858
- Oracle advisory URL as listed in the CVE record (unverified; see Patch Status): https://www.oracle.com/security-alerts/cspuaug2026.html