Oracle disclosed a critical (CVSS 9.6) vulnerability in the Security component of Oracle Hyperion Calculation Manager 11.2.25.0.000. Per the CVSS vector and Oracle's summary, successful exploitation could allow a low-privileged network attacker to read and modify data the product can reach; and, because of a scope change, potentially affect other products beyond it. The practical extent of that access in any given deployment will depend on configuration and has not been demonstrated publicly.
What Is It
The flaw sits in the Security component of Oracle Hyperion Calculation Manager, part of the Oracle Hyperion suite. Oracle describes it as an easily exploitable vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the product. No user interaction is required.
Critically, the CVSS vector carries a scope change (S:C): although the defect lives in Calculation Manager, successful attacks "may significantly impact additional products." That scope change is the main driver of the 9.6 base score despite the requirement for some level of prior access.
CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, network attack vector, low complexity, low privileges required, high confidentiality and integrity impact, no availability impact.
Why It Matters
Oracle's impact statement describes unauthorized creation, deletion, or modification of critical data, or all data accessible to Calculation Manager, plus unauthorized read access up to complete access to that same data. In a Hyperion deployment, that data is financial planning and consolidation content, and the integrity impact means an attacker may be able to alter it rather than merely steal it; potentially without leaving obvious traces in the application itself, depending on local logging and reconciliation controls.
The "low privileges required" rating is likely to be a thin barrier in practice: the vector suggests that a routine authenticated account, including a low-value or compromised one, may be enough, though Oracle has not published the specific privilege level or authentication path required. There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Hyperion Calculation Manager
- Component: Security
- Affected version: 11.2.25.0.000
This is the only supported version listed as affected in the NVD record.
Patch Status
Oracle ships Critical Patch Updates on a fixed quarterly cadence, January, April, July, and October, so there is no August 2026 CPU. The supplied data does not identify which CPU cycle carries the fix for this issue; based on the 2026-08-18 NVD publication date, it would fall under the July 2026 CPU or the upcoming October 2026 CPU. Administrators should check the relevant Oracle Critical Patch Update advisory and Hyperion patch documentation to confirm which release contains the fix.
The NVD record was published 2026-08-18 and remains in "Received" status, meaning NVD analysis is not yet complete; details may be enriched later. No specific remediation deadline is attached to this CVE in the supplied data.
Sources
- NVD, CVE-2026-62582: https://nvd.nist.gov/vuln/detail/CVE-2026-62582
- Oracle Critical Patch Update advisory, as supplied in the source data: https://www.oracle.com/security-alerts/cspuaug2026.html, this link should be treated as unreliable. It references an August 2026 CPU, which does not exist given Oracle's January/April/July/October cadence, and the filename does not match Oracle's advisory naming convention. It is reproduced here only for provenance; use Oracle's Critical Patch Update index (https://www.oracle.com/security-alerts/) to locate the correct advisory.