CVE-2026-70887 in Hyperion Data Relationship Management
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Hyperion Data Relationship Management product, specifically affecting version 11.2.25.0.000 in its Access and security component. This flaw represents a critical weakness in the authentication mechanisms that govern user interactions with the application via HTTP. The nature of this defect allows an unauthenticated attacker to bypass standard access controls without requiring any prior credentials or complex interaction from a victim user interface. Because the attack vector is network-based and requires low complexity, it can be executed remotely by adversaries who have connectivity to the target system over the internet or internal networks where the service is exposed.
From a technical perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as well as potentially CWE-306 for Missing Authentication for Critical Function if specific administrative actions are accessible without verification. The absence of proper validation checks at the entry points allows malicious actors to manipulate session states or directly invoke protected endpoints that should be restricted to authorized personnel only. This lack of enforcement creates a direct pathway into the core data management functionalities, undermining the fundamental security principle that users must prove their identity before being granted access to sensitive resources.
The operational impact of this vulnerability is severe due to its high confidentiality and integrity implications as indicated by the CVSS 3.1 base score of 8.2. Successful exploitation enables an attacker to gain unauthorized access to critical data stored within the Oracle Hyperion Data Relationship Management environment. This includes financial models, planning assumptions, and other sensitive business intelligence assets that are central to organizational decision-making processes. Furthermore, the vulnerability permits unauthorized updates, inserts, or deletes on accessible data sets. This capability allows attackers not only to exfiltrate information but also to corrupt or destroy critical records, leading to significant operational disruption and potential financial loss for the affected organization.
In terms of threat modeling, this scenario maps directly to MITRE ATT&CK technique T1078, Valid Accounts, although in this case it involves gaining access without valid credentials initially through a flaw that mimics authorized behavior. It also relates to T1530, Data from Cloud Storage Object Dumps if the underlying data is accessed via exposed storage interfaces, and generally falls under Initial Access or Privilege Escalation depending on how deep into the system the attacker can move after initial compromise. The ability to modify data introduces risks associated with Integrity violations which are critical in financial reporting contexts where accuracy and trustworthiness of data are paramount regulatory requirements.
Mitigation strategies must focus immediately on restricting network exposure and applying vendor-provided patches if available for version 11.2.25.0.000. Organizations should ensure that the Oracle Hyperion Data Relationship Management service is not directly accessible from untrusted networks such as the public internet without a robust web application firewall or reverse proxy in place to enforce additional access controls and rate limiting. Implementing strict network segmentation can also limit lateral movement if an initial breach occurs. Additionally, security teams should audit existing configurations for any other instances of improper authentication logic across related components within the Oracle Hyperion suite to prevent similar exploitation vectors from being leveraged against adjacent systems that may share underlying infrastructure or trust relationships.