CVE-2026-70679 Oracle CVE debrief

Who should care

Organizations using Oracle Hyperion Calculation Manager version 11.2.25.0.000 should prioritize remediation efforts. Security teams and administrators responsible for Oracle Hyperion products should review and apply the necessary patches and implement compensating controls to mitigate the vulnerability.

Technical summary

The vulnerability in Oracle Hyperion Calculation Manager (component: Security) allows unauthenticated attackers with network access via HTTP to compromise the manager. Successful attacks can result in unauthorized update, insert or delete access to some of Oracle Hyperion Calculation Manager accessible data. The CVSS 3.1 Base Score is 5.3 (Integrity impacts). The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Defensive priority

Medium-priority defensive actions are required to address the vulnerability in Oracle Hyperion Calculation Manager. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise the manager, potentially resulting in unauthorized data updates.

Recommended defensive actions

• Review and apply the vendor advisory from Oracle.
• Verify the affected version of Oracle Hyperion Calculation Manager and apply necessary patches.
• Implement compensating controls to monitor and restrict network access to the vulnerable component.
• Conduct regular inventory checks to ensure the vulnerability is remediated.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD details indicate that Oracle Hyperion Calculation Manager version 11.2.25.0.000 is vulnerable. The CVSS score is 5.3, with a Medium severity rating. The vulnerability is easily exploitable and allows unauthenticated attackers to compromise the manager, potentially resulting in unauthorized data updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.