Is CVE-2026-70902 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70902 being exploited in the wild.

How severe is CVE-2026-70902?

High severity, with a CVSS score of 7.1, published 18 August 2026.

Which products and versions are affected?

Oracle Hyperion Data Relationship Management 11.2.25.0.000.

Is there a fix for CVE-2026-70902?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-70902 attacked?

It is attacked with local access.

Am I affected by CVE-2026-70902?

Check whether you run Oracle Hyperion Data Relationship Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70902: Oracle Hyperion Data Relationship Management privilege escalation in access control

CVE-2026-70902 · Severity: high · CVSS 7.1 · Published 2026-08-18

Oracle Hyperion Data Relationship Management is an enterprise data management tool used to control financial and operational data relationships across organizations. A local privilege escalation vulnerability allows an authenticated user on the system to bypass access controls and gain unauthorized read/write access to sensitive corporate financial and operational data, posing a significant risk to data integrity and confidentiality.

Technologies: Oracle Hyperion Data Relationship Management. Vendors: Oracle.

Quick answers

Is CVE-2026-70902 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70902 being exploited in the wild.
How severe is CVE-2026-70902?: High severity, with a CVSS score of 7.1, published 18 August 2026.
Which products and versions are affected?: Oracle Hyperion Data Relationship Management 11.2.25.0.000.
Is there a fix for CVE-2026-70902?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-70902 attacked?: It is attacked with local access.
Am I affected by CVE-2026-70902?: Check whether you run Oracle Hyperion Data Relationship Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a privilege escalation flaw in the access and security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000. The attack requires local access to the infrastructure and valid logon credentials (low-privileged user), but does not require user interaction. An authenticated attacker can exploit insufficient access control validation to create, delete, or modify critical data, or gain complete unauthorized access to all data managed by the application. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates a local attack vector with high impact on confidentiality and integrity. Patch availability should be confirmed through Oracle's security updates.

Affected products

Oracle Hyperion Data Relationship Management 11.2.25.0.000

Timeline

2026-08-18: disclosed

References

https://www.oracle.com/security-alerts/cspuaug2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.