CVE-2026-70872 in Hyperion Data Relationship Management
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The Oracle Hyperion Data Relationship Management product, specifically version 11.2.25.0.000 within the Access and security component, contains a critical vulnerability that allows for unauthorized access to sensitive organizational data. This flaw is classified as an easily exploitable issue requiring no authentication from the attacker. The attack vector is network-based via HTTP, meaning that any remote adversary with connectivity to the affected system can attempt to exploit this weakness without needing valid credentials or user interaction. The severity of this vulnerability is underscored by a CVSS 3.1 Base Score of 9.1, indicating a high-risk situation where both confidentiality and integrity are severely compromised while availability remains largely unaffected in terms of service disruption but critically impacted regarding data control.
From a technical perspective, the absence of proper authentication checks within the HTTP handling mechanisms allows unauthenticated actors to bypass security controls designed to restrict access to critical datasets. This lack of enforcement enables attackers to perform unauthorized operations including creation, deletion, or modification of vital records stored within the Data Relationship Management system. Furthermore, it grants complete read access to all data accessible by the application, effectively stripping away the confidentiality guarantees expected in enterprise environments. The vulnerability aligns with CWE-287 Improper Authentication and CWE-359 Exposure of Private Information to an Unauthorized Actor, highlighting fundamental failures in identity verification processes that are central to secure software architecture standards.
The operational impact of this vulnerability is substantial for organizations relying on Oracle Hyperion Data Relationship Management for financial planning, budgeting, and consolidation activities. Since the system often houses sensitive financial projections, strategic plans, and proprietary business metrics, unauthorized access can lead to significant competitive disadvantage or regulatory non-compliance depending on industry-specific data protection laws such as GDPR or SOX. Attackers could alter critical figures to manipulate reporting outcomes, delete essential historical records for obfuscation purposes, or exfiltrate confidential information for espionage or ransomware deployment scenarios. The ability to modify data introduces risks of integrity violations that can distort decision-making processes at the executive level based on corrupted inputs.
Mitigation strategies must prioritize immediate remediation through vendor-provided patches if available, as this represents a high-severity flaw with active exploitation potential in unpatched environments. Organizations should also implement network-level controls such as web application firewalls to restrict HTTP access to only trusted IP ranges and enforce strict input validation on all endpoints exposed to the internet. Additionally, reviewing access logs for signs of unauthorized data retrieval or modification is crucial for incident response. Aligning with MITRE ATT&CK framework techniques, this vulnerability facilitates Initial Access via valid credentials being bypassed (T1078) and potentially Data Exfiltration over HTTP/S (T1041), necessitating robust monitoring and segmentation to limit lateral movement should the initial breach succeed.