CVE-2026-62446 Oracle Corporation CVE debrief

Who should care

Administrators and users of Oracle Hyperion Calculation Manager, security teams responsible for monitoring and patching vulnerabilities, and operators of affected systems should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

A vulnerability in Oracle Hyperion Calculation Manager allows unauthenticated attackers with network access via HTTP to compromise the system, resulting in unauthorized read access to a subset of accessible data. The supported version that is affected is 11.2.25.0.000. The CVSS 3.1 Base Score is 5.3 (Confidentiality impacts). The vulnerability allows unauthenticated attackers with network access via HTTP to compromise the system, resulting in unauthorized read access to a subset of accessible data. Defenders should verify the affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Defensive priority

Medium priority given the CVSS score of 5.3 and the potential for unauthorized read access.

Recommended defensive actions

• Review and apply patches from Oracle as available
• Monitor network access to Oracle Hyperion Calculation Manager
• Verify and limit access to sensitive data
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from the NVD and CVE.org suggests a medium severity vulnerability in Oracle Hyperion Calculation Manager. Further analysis is required to determine the full impact. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise the system, resulting in unauthorized read access to a subset of accessible data. Defenders should verify the affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources