CVE-2026-70894 is a high severity (CVSS 7.7) access control flaw in the Access and security component of Oracle Hyperion Data Relationship Management 11.2.25.0.000. An attacker with logon access to the host infrastructure can read and change the product's data. Oracle's fix is its August 2026 Critical Patch Update.
What's affected
Oracle Hyperion Data Relationship Management version 11.2.25.0.000, which Oracle lists as the supported affected version. The component is Access and security, and Oracle's risk matrix shows no network protocol, consistent with a local attack.
The weakness is CWE-284. The vector is AV:L/AC:L/PR:N/UI:N/S:U: local, low complexity, no privileges in the product itself, no user interaction, unchanged scope. Confidentiality and integrity impacts are high, availability none. Oracle describes the effect as unauthorized creation, deletion or modification of critical data and access to all data the product can reach.
Patch numbers vary by platform, so use the Oracle alert page for yours.
How to check if you're exposed
Check the installed Hyperion DRM version and patch level on each server. OPatch lists installed patches for the Oracle home:
$ORACLE_HOME/OPatch/opatch lsinventory
Compare with the patch in the Oracle August 2026 Critical Patch Update for Hyperion.
The attack requires logon to the infrastructure where the product runs, so the access list of the host matters. Review who has an operating system account on DRM servers, and remove access for people who do not need it.
free in-browser dependency scan is for application dependencies, not for Oracle product patches.
What to do now
- Read the Oracle CPU advisory for August 2026 and find the Hyperion DRM patch.
- Confirm the installed version is 11.2.25.0.000 or another version listed there.
- Apply the patch to a test environment, then production, following Oracle's instructions.
- Review operating system accounts on DRM servers and remove unneeded access.
- Check audit logs for unexpected changes to hierarchies and data that you cannot explain.
Why it matters
CWE-284 means the product does not correctly control who can access data or functions. In DRM, which maintains master data and hierarchies that finance systems rely on, unauthorized changes may flow into reports downstream.
The requirement of logon to the host narrows the field. It also shifts the focus to ordinary server hygiene: who can log in, how those accounts are reviewed, and whether a compromised low privilege account elsewhere could become a path to this host.
Quick check
Does the attacker need a Hyperion account?
Oracle describes an unauthenticated attacker with logon to the infrastructure where the product runs. They need access to the host, not an account in the product.
Sources
Last reviewed: 18 October 2026.
