Description
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Data Relationship Management executes to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-08-18
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Oracle Hyperion Data Relationship Management product contains an access and security flaw that can be exploited by an attacker who has a low‑privileged account on the same host. Successfully leveraging this weakness gives the attacker full control over the Hyperion application, resulting in complete loss of confidentiality, integrity, and availability.

Affected Systems

The affected version is 11.2.25.0.000, delivered by Oracle Corporation. Any deployment of this product that resides on a host where a low‑privileged local user exists is vulnerable.

Risk and Exploitability

The CVSS v3.1 base score of 7.8 indicates high severity. The attack vector is local (AV:L) and requires low privileges (PR:L). The attack complexity is high, meaning that exploitation is not trivial, but the potential for application takeover makes it a significant risk. EPSS is < 1%, indicating a low exploitation probability, and the vulnerability is not listed in CISA KEV. Despite these factors, the high impact necessitates prompt remediation.

Generated by OpenCVE AI on August 21, 2026 at 17:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the vendor’s latest patch for Hyperion Data Relationship Management 11.2.25.0.000 or any available update that addresses the vulnerability.
  • Remove or severely restrict local accounts on hosts running Hyperion to eliminate low‑privileged access that could be abused.
  • Isolate Hyperion servers from the rest of the environment by implementing network segmentation or dedicated workstations, ensuring that local compromise of the application cannot be leveraged to reach other critical systems.
  • Enable detailed logging and audit local user activity on Hyperion servers, and monitor for suspicious operations that may indicate exploitation attempts.

Generated by OpenCVE AI on August 21, 2026 at 17:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Title Low‑Privileged Local User Compromise Allows Full Application Takeover in Oracle Hyperion Data Relationship Management 11.2.25.0.000

Fri, 21 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Fri, 21 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Title Low‑Privileged Local User Compromise Allows Full Application Takeover in Oracle Hyperion Data Relationship Management 11.2.25.0.000
Weaknesses CWE-284

Fri, 21 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
Title Local‑Privilege Attack Enables Complete Takeover of Oracle Hyperion Data Relationship Management
Weaknesses CWE-284

Wed, 19 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Title Local‑Privilege Attack Enables Complete Takeover of Oracle Hyperion Data Relationship Management
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Data Relationship Management executes to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Data Relationship Management
CPEs cpe:2.3:a:oracle:hyperion_data_relationship_management:11.2.25.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Data Relationship Management
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Data Relationship Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T15:20:07.732Z

Reserved: 2026-08-04T22:06:34.603Z

Link: CVE-2026-70879

cve-icon Vulnrichment

Updated: 2026-08-24T15:12:28.455Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:17:44.370

Modified: 2026-08-24T16:17:22.137

Link: CVE-2026-70879

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T17:45:03Z

Weaknesses