CVE-2026-70901 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Hyperion Data Relationship Management should review and apply security patches, restrict network access, and monitor for suspicious activity. This is a high priority due to the high CVSS score of 8.1 and potential for unauthorized creation, deletion or modification access to critical data. Security teams and administrators responsible for Oracle Hyperion Data Relationship Management deployments should take immediate action to protect their systems. Additionally, operators and platform administrators should be aware of the vulnerability and its potential impact on their systems. Vulnerability management teams should prioritize patching and ensure that compensating controls are in place for exposed systems. Monitoring and detection teams should review relevant logs and tracking for exposed assets that need extra review. Asset inventory and change management teams should also be involved in the remediation process to ensure that affected systems are properly updated and verified. IT security teams should coordinate with Oracle support and ensure that patches are applied according to vendor guidance and organizational change control processes. Compliance and risk management teams should assess the potential impact of this vulnerability on their organization's risk profile and ensure that appropriate measures are taken to mitigate the risk. Finally, incident response teams should be prepared to respond to potential security incidents related to this vulnerability. The CVE record was published on 2026-08-18T21:17:47.820Z and has not been modified since then, so it is essential to act based on the current information available. Limited details are available on exploitability and affected systems, emphasizing the need for caution and thorough review of system deployments and configurations. The vulnerability's impact on data confidentiality and integrity highlights the importance of prompt action to protect sensitive information. By taking these steps, organizations can minimize the risk associated with this vulnerability and protect their systems and data from potential attacks. Security patches should be applied as soon as possible, and any

Technical summary

The Oracle Hyperion Data Relationship Management product has a vulnerability in the Access and security component. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. The CVSS 3.1 Base Score is 8.1 (Confidentiality and Integrity impacts).

Defensive priority

High priority due to high CVSS score of 8.1 and potential for unauthorized creation, deletion or modification access to critical data.

Recommended defensive actions

• Review and apply Oracle security patches for affected products
• Restrict network access to Oracle Hyperion Data Relationship Management
• Monitor for suspicious activity and implement compensating controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence from official CVE and NVD sources indicates a vulnerability in Oracle Hyperion Data Relationship Management with a CVSS score of 8.1. Limited details are available on exploitability and affected systems.

Official resources