PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-62533 Oracle Corporation CVE debrief

The CVE-2026-62533 record indicates a low-severity vulnerability in Oracle Hyperion Calculation Manager version 11.2.25.0.000. This difficult-to-exploit vulnerability allows unauthenticated attackers with network access via HTTP to potentially read a subset of accessible data. The CVSS 3.1 score is 3.7, focusing on confidentiality impacts. Organizations should review their inventory and apply patches if available. The vulnerability's CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. It is crucial for network administrators and security teams to prioritize monitoring and securing network access to the affected systems. Additionally, verifying compensating controls for data access is essential. The CVE record was published on 2026-08-18T21:17:05.900Z and has not been modified since then.

Vendor
Oracle Corporation
Product
Oracle Hyperion Calculation Manager
CVSS
LOW 3.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-08-25
Advisory published
2026-08-18
Advisory updated
2026-08-25

Who should care

Organizations using Oracle Hyperion Calculation Manager version 11.2.25.0.000 should review their inventory and apply patches if available. Network administrators and security teams responsible for Oracle Hyperion products should prioritize monitoring and securing network access to the affected systems.

Technical summary

CVE-2026-62533 is a low-severity vulnerability in Oracle Hyperion Calculation Manager version 11.2.25.0.000. It is a difficult-to-exploit vulnerability that allows unauthenticated attackers with network access via HTTP to potentially read a subset of accessible data. The CVSS 3.1 score is 3.7, with a focus on confidentiality impacts. The vulnerability's CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Organizations using Oracle Hyperion Calculation Manager should review their inventory and apply patches if available. Network administrators and security teams should prioritize monitoring and securing network access to the affected systems. Additionally, verifying compensating controls for data access is essential.

Defensive priority

Review Oracle Hyperion Calculation Manager inventory for version 11.2.25.0.000 and apply vendor patches if available.

Recommended defensive actions

  • Review Oracle Hyperion Calculation Manager inventory for version 11.2.25.0.000
  • Apply vendor patches if available
  • Monitor network access to Oracle Hyperion Calculation Manager
  • Verify compensating controls for data access
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE-2026-62533 record indicates a low-severity vulnerability in Oracle Hyperion Calculation Manager version 11.2.25.0.000. The vulnerability is difficult to exploit and allows unauthenticated attackers with network access via HTTP to potentially read a subset of accessible data. The CVSS 3.1 score is 3.7, focusing on confidentiality impacts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-62533 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-62533

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-62533 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-62533

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.