CVE-2026-60858: Oracle Hyperion Auth Bypass Vulnerability

CVE-2026-60858 Overview

CVE-2026-60858 is a critical vulnerability in the Oracle Hyperion Calculation Manager product, part of the Oracle Hyperion suite. The flaw resides in the Security component and affects version 11.2.25.0.000. An unauthenticated remote attacker can exploit the vulnerability over HTTP without user interaction. Successful exploitation leads to complete takeover of Oracle Hyperion Calculation Manager, with full impact on confidentiality, integrity, and availability. The underlying weakness is classified as Missing Authentication for Critical Function [CWE-306].

Critical Impact
Unauthenticated network attackers can fully compromise Oracle Hyperion Calculation Manager over HTTP, resulting in complete system takeover.

Affected Products

Oracle Hyperion Calculation Manager 11.2.25.0.000
Oracle Hyperion (Security component)
Deployments exposing the Calculation Manager HTTP interface to untrusted networks

Discovery Timeline

2026-08-18 - CVE-2026-60858 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60858

Vulnerability Analysis

The vulnerability affects the Security component of Oracle Hyperion Calculation Manager. Oracle classifies the issue as easily exploitable, requiring only network access via HTTP. No authentication or user interaction is required to reach the vulnerable code path. Successful exploitation results in takeover of the Calculation Manager instance, giving the attacker full read, write, and disruption capabilities over the application and its data. Hyperion Calculation Manager is commonly deployed in enterprise financial planning environments, so compromise can expose sensitive financial models and calculation logic. The EPSS score at publication is 0.522% (percentile 42.168), indicating measurable near-term exploitation likelihood among internet-exposed instances.

Root Cause

The issue is categorized under [CWE-306] Missing Authentication for Critical Function. A security-relevant operation exposed by the Calculation Manager HTTP interface does not enforce authentication before executing privileged actions. This design flaw allows any network-reachable actor to invoke functionality that should require authenticated, authorized access.

Attack Vector

Exploitation is remote and network-based. An attacker sends crafted HTTP requests to the Calculation Manager endpoint exposed by an affected Oracle Hyperion deployment. Because authentication is not enforced on the vulnerable functionality, the request executes with the privileges of the application. Oracle has not published exploit details, and no public proof-of-concept is available. Consult the Oracle Security Alert for authoritative technical guidance.

Detection Methods for CVE-2026-60858

Indicators of Compromise

Unauthenticated HTTP requests to Calculation Manager endpoints originating from unexpected internal or external sources.
New or modified calculation rules, business rules, or scripts within Hyperion Calculation Manager without corresponding change-management records.
Unexpected administrative actions logged in Hyperion audit trails outside authorized user sessions.

Detection Strategies

Inspect web server and reverse proxy logs for HTTP requests to Calculation Manager paths that lack valid session cookies or authorization headers.
Compare application configuration and rule inventories against known-good baselines to identify unauthorized modifications.
Correlate Hyperion application logs with network flow data to identify anomalous client IPs interacting with the Calculation Manager interface.

Monitoring Recommendations

Forward Hyperion Calculation Manager application logs and WebLogic access logs to a centralized SIEM for continuous review.
Alert on HTTP 200 responses to sensitive Calculation Manager endpoints when the request lacks authentication tokens.
Monitor for outbound connections from the Hyperion application server to non-standard destinations following inbound HTTP activity.

How to Mitigate CVE-2026-60858

Immediate Actions Required

Apply the fix referenced in the Oracle Security Alert as soon as change controls permit.
Restrict network access to Oracle Hyperion Calculation Manager so that only authorized internal management networks can reach the HTTP interface.
Audit Calculation Manager business rules, scripts, and configuration for unauthorized changes made prior to patching.

Patch Information

Oracle addressed CVE-2026-60858 in the August 2026 security guidance. Administrators should review the Oracle Security Alert for the specific patch applicable to Oracle Hyperion Calculation Manager 11.2.25.0.000 and apply it following Oracle's documented upgrade procedures.

Workarounds

Place Calculation Manager behind a reverse proxy or WAF that enforces authentication and blocks unauthenticated requests to sensitive paths.
Segment the Hyperion environment so that the Calculation Manager HTTP port is unreachable from user networks and the internet.
Disable or take offline any Calculation Manager instance that cannot be patched or protected by network controls until remediation is complete.

bash

# Configuration example: restrict Calculation Manager HTTP access at the network layer
# Replace 10.10.20.0/24 with your authorized administrative subnet
iptables -A INPUT -p tcp --dport 19000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 19000 -j DROP