Summary
generated automatically from NVD dataCVE-2026-70880 affects the Access and security component of Oracle Hyperion Data Relationship Management, version 11.2.25.0.000, and is classified as an improper access control weakness (CWE-284). An unauthenticated attacker with network access over TCP can easily exploit it to take over the product, and because of a scope change the impact may extend to additional products. It carries a CVSS 3.1 score of 10.0 (CRITICAL), with high confidentiality, integrity and availability impacts.
NVD description
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
EPSS · FIRST.org
0.51%probability of exploitation in the next 30 days
Higher than 41% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 18 août 2026
- Updated
- 24 août 2026
- Status
- Analyzed
- Source
- secalert_us@oracle.com
Affected products
Weaknesses (CWE)
References (1)
- https://www.oracle.com/security-alerts/cspuaug2026.htmlVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-284
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.