PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-70904 Oracle Corporation CVE debrief

The CVE-2026-70904 vulnerability affects the Oracle Hyperion Data Relationship Management product, specifically version 11.2.25.0.000. This vulnerability is classified as a high-severity issue, with a CVSS 3.1 Base Score of 8.1, indicating a high impact on confidentiality and integrity. The vulnerability allows an unauthenticated attacker with access to the physical communication segment to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. Organizations using this product should prioritize patching to prevent potential unauthorized access and data manipulation. The CVE record was published on 2026-08-18T21:17:48.167Z and has not been modified since then.

Vendor
Oracle Corporation
Product
Oracle Hyperion Data Relationship Management
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-08-22
Advisory published
2026-08-18
Advisory updated
2026-08-22

Who should care

Organizations using Oracle Hyperion Data Relationship Management product, specifically version 11.2.25.0.000, should prioritize patching this vulnerability to prevent potential unauthorized access and data manipulation.

Technical summary

The CVE-2026-70904 vulnerability affects Oracle Hyperion Data Relationship Management product, specifically version 11.2.25.0.000. The vulnerability allows an unauthenticated attacker with access to the physical communication segment to compromise the product. Successful attacks can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. The CVSS 3.1 Base Score is 8.1 (Confidentiality and Integrity impacts).

Defensive priority

High priority due to high CVSS score of 8.1 and potential for unauthorized creation, deletion or modification access to critical data.

Recommended defensive actions

  • Review and apply Oracle's security patches for CVE-2026-70904
  • Restrict access to the physical communication segment attached to the hardware where Oracle Hyperion Data Relationship Management executes
  • Monitor Oracle Hyperion Data Relationship Management for suspicious activity
  • Implement compensating controls to detect and prevent unauthorized access
  • Conduct a thorough review of the affected system's exposure and assign an owner for follow-up
  • Verify that the current configuration and environment align with Oracle's security guidelines for the product
  • Track and document the remediation process, including any exceptions or retesting of remediated assets

Evidence notes

The CVE-2026-70904 vulnerability affects Oracle Hyperion Data Relationship Management product, specifically version 11.2.25.0.000. The vulnerability allows an unauthenticated attacker with access to the physical communication segment to compromise the product. Successful attacks can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T21:17:48.167Z and has not been modified since then.