CVE-2026-70875 in Hyperion Data Relationship Management
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management, specifically affecting version 11.2.25.0.000. This flaw represents a critical weakness in how the application handles authentication and authorization processes over HTTP connections. Although the exploitation complexity is classified as high, requiring specific conditions to be met by an attacker, the severity of the potential outcome elevates the risk profile significantly. The vulnerability allows for unauthorized access that can lead to complete system compromise if successfully leveraged against a low-privileged user with network connectivity to the affected service.
From a technical perspective, this issue likely stems from improper validation or enforcement of security controls within the HTTP request handling mechanisms. While the high attack complexity suggests that an attacker may need specific knowledge of internal states or precise timing conditions to trigger the flaw, the fact that it requires only low privileges and network access makes it particularly dangerous in environments where default accounts are used or where users have minimal restrictions. The absence of user interaction requirements further simplifies the exploitation path for automated tools once the initial complex condition is satisfied.
The operational impact of this vulnerability is severe, as indicated by a CVSS 3.1 base score of 7.5. A successful exploit results in full takeover of Oracle Hyperion Data Relationship Management, impacting confidentiality, integrity, and availability equally. This means an attacker could potentially exfiltrate sensitive financial data stored within the system, alter critical business rules or configurations without detection, and disrupt service availability for other users relying on the platform. Such a compromise undermines the core trust model of enterprise resource planning tools that rely on accurate and secure data management.
In terms of industry standard classifications, this vulnerability aligns with CWE-287 Improper Authentication or CWE-269 Improvement of Privileges depending on the specific mechanism exploited within the access control logic. It also maps to MITRE ATT&CK techniques related to Initial Access via valid accounts and potentially Lateral Movement if the compromised account is used to pivot further into the network. The high attack complexity serves as a mitigating factor in scoring but does not eliminate the risk, especially given the critical nature of the affected application.
To mitigate this risk, organizations should immediately apply the latest security patches provided by Oracle for version 11.2.25.0.000 and subsequent updates that address these access control flaws. It is crucial to ensure that all administrative interfaces are not exposed directly over HTTP without additional layers of encryption such as TLS. Network segmentation strategies should be reviewed to restrict direct internet-facing access to Hyperion servers, placing them behind secure proxies or firewalls with strict ingress filtering. Additionally, enforcing multi-factor authentication for all user accounts and regularly auditing privilege assignments can reduce the likelihood of successful exploitation even if a vulnerability is present. Monitoring logs for anomalous login patterns or unusual HTTP request structures may also aid in early detection of attempted exploits targeting this specific weakness.