CVE-2026-70874 in Data Relationship Management
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management, specifically affecting version 11.2.25.0.000. This flaw represents a critical weakness in the application's authentication or authorization mechanisms, allowing an attacker to bypass intended access controls. The nature of this defect suggests that the system fails to properly validate user credentials or session tokens when processing requests over HTTP. As a result, individuals with low-privileged accounts can escalate their privileges or impersonate higher-level users without requiring complex exploitation techniques or social engineering interactions such as user interface manipulation.
From an operational perspective, the impact of this vulnerability is severe due to its high exploitability and broad scope. The CVSS 3.1 base score of 8.8 indicates a High severity rating, driven by significant impacts on confidentiality, integrity, and availability. An attacker with network access via HTTP can leverage this flaw to gain full control over the Oracle Hyperion Data Relationship Management instance. This takeover capability means that sensitive financial data, reporting structures, and business intelligence insights stored within the platform could be exfiltrated, altered, or destroyed. The lack of user interaction requirements further lowers the barrier for entry, making automated exploitation tools highly effective against this target.
In terms of industry standard classifications, this vulnerability aligns with CWE-287 Improper Authentication or CWE-269 Improvement of Privileges depending on whether the attacker is bypassing login checks or escalating existing privileges. The attack vector corresponds to ATT&CK technique T1078 Valid Accounts, where adversaries use legitimate credentials obtained through various means to maintain access and move laterally within a network environment. Given that Oracle Hyperion Data Relationship Management often serves as a central repository for enterprise financial planning and analysis, compromising this system can have cascading effects on organizational decision-making processes and regulatory compliance status.
Mitigation strategies must focus on immediate remediation of the underlying code defect through official vendor patches provided by Oracle. Organizations should ensure they are running the latest supported version that includes security fixes for access control mechanisms. In the interim, network-level controls such as restricting HTTP access to trusted IP ranges or enforcing HTTPS with strong certificate validation can reduce the attack surface. Additionally, implementing multi-factor authentication and monitoring for anomalous login patterns from low-privileged accounts may help detect exploitation attempts before they result in a full system compromise. Regular security audits and penetration testing of the Hyperion environment are recommended to identify similar weaknesses in access control logic across other modules.