CVE-2026-70895 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Hyperion Data Relationship Management version 11.2.25.0.000 should prioritize patching or mitigating this vulnerability to prevent potential unauthorized access to critical data.

Technical summary

The CVE-2026-70895 vulnerability is in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Data Relationship Management executes to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Defensive priority

Medium priority given the CVSS score of 6.5 and the potential for unauthorized access to critical data.

Recommended defensive actions

• Inventory and verify the Oracle Hyperion Data Relationship Management version 11.2.25.0.000 is not in use or apply vendor patches if available.
• Implement compensating controls such as monitoring and exception tracking for potential unauthorized access.
• Restrict logon access to the infrastructure where Oracle Hyperion Data Relationship Management executes to trusted users only.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-70895 vulnerability affects Oracle Hyperion Data Relationship Management, version 11.2.25.0.000. The vulnerability allows a low-privileged attacker with logon access to compromise the product, potentially impacting additional products. The CVSS 3.1 Base Score is 6.5, with Confidentiality impacts.

Official resources