CVE-2026-70897 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Hyperion Data Relationship Management version 11.2.25.0.000 should prioritize patching this vulnerability. Additionally, security teams and IT administrators responsible for managing and securing Oracle Hyperion products should be aware of this vulnerability and take necessary actions to mitigate potential risks.

Technical summary

The CVE-2026-70897 vulnerability affects Oracle Hyperion Data Relationship Management version 11.2.25.0.000. It is an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTPS to compromise the product. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data. The CVSS 3.1 Base Score is 8.2 with Confidentiality and Integrity impacts.

Defensive priority

High priority due to high CVSS score of 8.2 and potential for unauthorized access to critical data.

Recommended defensive actions

• Review and apply Oracle's security patches for the affected product version.
• Implement compensating controls such as network segmentation and access controls.
• Monitor for suspicious activity and implement logging and auditing.
• Verify inventory of installed products and ensure only necessary components are present.
• Consider implementing additional security measures such as multi-factor authentication.

Evidence notes

The CVE-2026-70897 record indicates a vulnerability in Oracle Hyperion Data Relationship Management with a CVSS score of 8.2. The supported version affected is 11.2.25.0.000. The vulnerability allows an unauthenticated attacker with network access via HTTPS to compromise the product, potentially leading to unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data.

Official resources