PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-70678 Oracle CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T21:17:19.610Z and has not been modified since then. The CVE-2026-70678 vulnerability in Oracle Hyperion Calculation Manager is confirmed, with a CVSS score of 7.6, indicating high severity. The vulnerability allows low-privileged attackers with network access via HTTP to compromise the system, potentially impacting additional products. Successful attacks require human interaction. The affected version is 11.2.25.0.000. Organizations should review their deployments, prioritize patching, and monitor for suspicious activity. This debrief provides an overview of the vulnerability, its potential impact, and recommended actions for affected organizations.

Vendor
Oracle
Product
Hyperion Calculation Manager
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-08-25
Advisory published
2026-08-18
Advisory updated
2026-08-25

Who should care

Organizations using Oracle Hyperion Calculation Manager version 11.2.25.0.000 should prioritize patching this vulnerability. Low-privileged attackers with network access via HTTP can exploit this vulnerability, potentially impacting additional products. Human interaction is required for successful attacks, indicating the need for user education and monitoring.

Technical summary

CVE-2026-70678 is a high-severity vulnerability in Oracle Hyperion Calculation Manager, with a CVSS score of 7.6. It allows low-privileged attackers with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized access to critical data or complete access to all Oracle Hyperion Calculation Manager accessible data, as well as unauthorized update, insert, or delete access to some of the data. The affected version is 11.2.25.0.000.

Defensive priority

Oracle Hyperion Calculation Manager vulnerability allows low-privileged attackers to compromise the system, emphasizing the need for network access controls and user interaction monitoring.

Recommended defensive actions

  • Apply vendor patches or updates as available
  • Restrict network access to Oracle Hyperion Calculation Manager
  • Monitor user interactions and system logs for suspicious activity
  • Implement compensating controls for additional product scope
  • Conduct regular vulnerability assessments and inventory checks

Evidence notes

The CVE-2026-70678 vulnerability in Oracle Hyperion Calculation Manager is confirmed, with a CVSS score of 7.6, indicating high severity. The vulnerability allows low-privileged attackers with network access via HTTP to compromise the system, potentially impacting additional products. Successful attacks require human interaction. The affected version is 11.2.25.0.000.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-70678 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-70678

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-70678 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-70678

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.