CVE-2026-70887 Oracle CVE debrief

Who should care

Organizations using Oracle Hyperion Data Relationship Management version 11.2.25.0.000 should prioritize patching this vulnerability. Security teams and IT administrators responsible for Oracle products should review and apply the necessary security patches.

Technical summary

CVE-2026-70887 is a vulnerability in Oracle Hyperion Data Relationship Management, specifically in the Access and security component. The affected version is 11.2.25.0.000. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data, as well as unauthorized update, insert, or delete access to some data. The CVSS 3.1 Base Score is 8.2, indicating high severity with Confidentiality and Integrity impacts. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.

Defensive priority

Oracle Hyperion Data Relationship Management vulnerability allows unauthenticated network access via HTTP, potentially leading to unauthorized data access and modification.

Recommended defensive actions

• Review and apply Oracle's security patches for Hyperion Data Relationship Management
• Restrict network access to the affected system
• Monitor for suspicious activity
• Verify system configurations and inventory
• Conduct a thorough review of system logs to identify potential security breaches
• Implement additional security measures such as multi-factor authentication and intrusion detection systems
• Regularly review and update security patches for all Oracle products

Evidence notes

The CVE-2026-70887 vulnerability affects Oracle Hyperion Data Relationship Management version 11.2.25.0.000. It allows unauthenticated attackers with network access via HTTP to compromise the system, potentially leading to unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete access to some data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.