CVE-2026-70892 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Hyperion Data Relationship Management 11.2.25.0.000 should be aware of this high-severity vulnerability and prioritize patching or implementing compensating controls to minimize potential impact.

Technical summary

The CVE-2026-70892 vulnerability is in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. This difficult-to-exploit vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. The CVSS 3.1 Base Score is 8.2 (Confidentiality and Integrity impacts). The CVSS Vector is (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

Defensive priority

Organizations using Oracle Hyperion Data Relationship Management 11.2.25.0.000 should prioritize patching due to the high CVSS score of 8.2 and potential for significant impact on additional products.

Recommended defensive actions

• Apply patches or updates provided by Oracle to address the vulnerability in Oracle Hyperion Data Relationship Management 11.2.25.0.000.
• Restrict network access to Oracle Hyperion Data Relationship Management to minimize the attack surface.
• Monitor Oracle Hyperion Data Relationship Management for suspicious activity and implement compensating controls if patching is not immediately feasible.
• Review and update asset inventory to identify affected systems.
• Implement additional monitoring and detection measures for exposed assets.
• Plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions and retest remediated assets.

Evidence notes

The CVE-2026-70892 vulnerability affects Oracle Hyperion Data Relationship Management 11.2.25.0.000. It is a difficult-to-exploit vulnerability that allows low-privileged attackers with network access via HTTP to compromise the product. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data, as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data.

Official resources