CVE-2026-70873 in Data Relationship Management
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Oracle Hyperion Data Relationship Management product contains a critical security flaw within its Access and Security component, specifically affecting version 11.2.25.0.000. This vulnerability represents a severe risk to organizational infrastructure due to the high degree of accessibility required for exploitation. The flaw allows an unauthenticated attacker who has network access via TCP to compromise the system without needing valid credentials or user interaction. This characteristic significantly lowers the barrier to entry for malicious actors, enabling remote code execution or full system takeover from any location on the network where the service is reachable.
The technical nature of this vulnerability aligns with CWE-287, which describes Improper Authentication, and potentially CWE-434 if it involves uploading dangerous file types that are then executed by the application server. The absence of proper authentication checks in the access control logic allows attackers to bypass security boundaries entirely. By exploiting this weakness, an attacker can gain unauthorized administrative privileges over the Oracle Hyperion Data Relationship Management environment. This level of access is particularly dangerous because these systems often handle sensitive financial data and critical business intelligence reports.
The operational impact of a successful exploitation is catastrophic for affected organizations. With a CVSS 3.1 Base Score of 9.8, indicating High severity across all metrics, the vulnerability impacts Confidentiality, Integrity, and Availability equally. An attacker achieving full system takeover can exfiltrate confidential financial data, alter critical business records to manipulate reporting outcomes, or disrupt services by crashing the application server. This aligns with ATT&CK techniques such as T1078 Valid Accounts if the attacker escalates privileges after initial access, or T1505 Server Software Component if they install backdoors within the Hyperion infrastructure for persistent control.
Mitigation strategies must be implemented immediately to address this critical exposure. Organizations should apply the latest security patches provided by Oracle as soon as they are available for version 11.2.25.0.000. In cases where patching is not immediately feasible, network segmentation and firewall rules should be configured to restrict TCP access to the Hyperion server ports only from trusted internal subnets or specific management IPs. Additionally, deploying a Web Application Firewall can help filter out malicious requests that attempt to exploit this authentication bypass before they reach the application layer. Continuous monitoring of system logs for unusual login attempts or unauthorized administrative actions is also recommended to detect potential exploitation activities early in the kill chain.