CVE-2026-70889 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Hyperion Data Relationship Management version 11.2.25.0.000 should prioritize patching this vulnerability. Security teams and administrators responsible for Oracle products should review and apply the necessary security patches. IT managers and cybersecurity professionals overseeing Oracle Hyperion Data Relationship Management deployments should ensure their environments are protected against this vulnerability.

Technical summary

The CVE-2026-70889 vulnerability affects Oracle Hyperion Data Relationship Management version 11.2.25.0.000. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise the product. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. The CVSS 3.1 Base Score is 7.5 with a focus on Confidentiality impacts. This vulnerability is considered high priority due to its high CVSS score and the potential for unauthorized access to critical data.

Defensive priority

High priority due to high CVSS score of 7.5 and potential for unauthorized access to critical data.

Recommended defensive actions

• Review and apply Oracle's security patches for the affected product version.
• Implement compensating controls such as network segmentation and access restrictions.
• Monitor for suspicious activity and implement logging and auditing.
• Verify inventory of installed products and ensure version 11.2.25.0.000 is properly patched.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

Evidence from official sources indicates a vulnerability in Oracle Hyperion Data Relationship Management with a CVSS score of 7.5. The supported version affected is 11.2.25.0.000. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise the product, potentially leading to unauthorized access to critical data.

Official resources