Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-70894

CVE-2026-70894HIGH

Oracle Corporation Oracle Hyperion Data Relationship Management — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  N    7.1   .0016    4.6     —

AFFECTED
  Product                                       Versions         Fixed
  Oracle Hyperion Data Relationship Management  11.2.25.0.000 –  —

TIMELINE
  Aug 4   Reserved by oracle
  Aug 18  Published (CNA: oracle)
  Aug 24  RESCORED — CVE-2026-70894 (Oracle Corporation Oracle Hyperion Data Relationship Management). CVSS 7.7 → 7.1 (NVD).

CWE-284 · CNA: oracle · CVSS v3.1 · 1 reference · NVD status: Analyzed

Description

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hyperion Data Relationship Management executes to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 4, 2026	Reserved	Reserved by oracle
August 18, 2026	Published	Published (CNA: oracle)
August 24, 2026	RESCORED	RESCORED — CVE-2026-70894 (Oracle Corporation Oracle Hyperion Data Relationship Management). CVSS 7.7 → 7.1 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Oracle Corporation	Oracle Hyperion Data Relationship Management	—	11.2.25.0.000	—

Weaknesses

CWE-284

References (1)

https://www.oracle.com/security-alerts/cspuaug2026.html [Vendor Advisory]

Authoritative record: CVE-2026-70894 at cve.org

Vendors: oracle

Weaknesses: CWE-284

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-70894 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.