SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-62582 2026-08-18

CVE-2026-62582: Critical Scope-Changing Flaw in Oracle Hyperion Calculation Manager

"Oracle disclosed a critical (CVSS 9.6) vulnerability in the Security component of Oracle Hyperion Calculation Manager 11.2.25.0.000. Per the CVSS vector and Oracle's summary, successful exploitation could allow a…"

Oracle disclosed a critical (CVSS 9.6) vulnerability in the Security component of Oracle Hyperion Calculation Manager 11.2.25.0.000. Per the CVSS vector and Oracle's summary, successful exploitation could allow a low-privileged network attacker to read and modify data the product can reach; and, because of a scope change, potentially affect other products beyond it. The practical extent of that access in any given deployment will depend on configuration and has not been demonstrated publicly.

What Is It

The flaw sits in the Security component of Oracle Hyperion Calculation Manager, part of the Oracle Hyperion suite. Oracle describes it as an easily exploitable vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the product. No user interaction is required.

Critically, the CVSS vector carries a scope change (S:C): although the defect lives in Calculation Manager, successful attacks "may significantly impact additional products." That scope change is the main driver of the 9.6 base score despite the requirement for some level of prior access.

CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, network attack vector, low complexity, low privileges required, high confidentiality and integrity impact, no availability impact.

Why It Matters

Oracle's impact statement describes unauthorized creation, deletion, or modification of critical data, or all data accessible to Calculation Manager, plus unauthorized read access up to complete access to that same data. In a Hyperion deployment, that data is financial planning and consolidation content, and the integrity impact means an attacker may be able to alter it rather than merely steal it; potentially without leaving obvious traces in the application itself, depending on local logging and reconciliation controls.

The "low privileges required" rating is likely to be a thin barrier in practice: the vector suggests that a routine authenticated account, including a low-value or compromised one, may be enough, though Oracle has not published the specific privilege level or authentication path required. There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.

What's Vulnerable

This is the only supported version listed as affected in the NVD record.

Patch Status

Oracle ships Critical Patch Updates on a fixed quarterly cadence, January, April, July, and October, so there is no August 2026 CPU. The supplied data does not identify which CPU cycle carries the fix for this issue; based on the 2026-08-18 NVD publication date, it would fall under the July 2026 CPU or the upcoming October 2026 CPU. Administrators should check the relevant Oracle Critical Patch Update advisory and Hyperion patch documentation to confirm which release contains the fix.

The NVD record was published 2026-08-18 and remains in "Received" status, meaning NVD analysis is not yet complete; details may be enriched later. No specific remediation deadline is attached to this CVE in the supplied data.

Sources