CVE-2026-70678: Oracle Hyperion Auth Bypass Vulnerability

CVE-2026-70678 Overview

CVE-2026-70678 is a high-severity vulnerability in the Security component of Oracle Hyperion Calculation Manager, part of the Oracle Hyperion product family. The affected version is 11.2.25.0.000. A low-privileged attacker with network access over HTTP can exploit the flaw, provided a legitimate user is tricked into interacting with attacker-supplied content. Successful exploitation crosses a security scope boundary, allowing unauthorized read access to all data accessible to Oracle Hyperion Calculation Manager and unauthorized update, insert, or delete access to a subset of that data. The scope change indicates that impact can extend beyond the vulnerable component to additional Oracle Hyperion products.

Critical Impact
Authenticated attackers can coerce user interaction to gain full read access and partial write access to Oracle Hyperion Calculation Manager data, with impact spilling into adjacent Oracle Hyperion components.

Affected Products

Oracle Hyperion Calculation Manager 11.2.25.0.000
Oracle Hyperion (Security component)
Downstream Oracle Hyperion products reachable through the scope change

Discovery Timeline

2026-08-18 - CVE-2026-70678 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70678

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle Hyperion Calculation Manager. Oracle classifies the flaw as easily exploitable over HTTP by an attacker holding low-privileged credentials. Exploitation requires human interaction from a user other than the attacker, indicating a client-side trigger such as a crafted link or form submission processed by an authenticated victim.

The scope change is the defining technical characteristic. A successful attack against Calculation Manager can influence data and resources managed by other Oracle Hyperion components sharing the same trust boundary. Confidentiality impact is rated high, while integrity impact is limited to a subset of accessible data. Availability is not affected.

Root Cause

Oracle has not published root-cause details for CVE-2026-70678. The combination of network attack vector, low privilege requirement, required user interaction, and scope change is consistent with a web-based flaw in the Security component such as cross-site request forgery, reflected content injection, or insufficient authorization validation on user-triggered actions. Refer to the Oracle Security Alert for authoritative technical detail.

Attack Vector

An attacker authenticates to Oracle Hyperion Calculation Manager with a low-privileged account reachable over HTTP. The attacker then crafts content, such as a URL or embedded request, and delivers it to a second Hyperion user through email, chat, or a shared portal. When the targeted user interacts with the payload while authenticated, the request executes in that user's session and crosses the scope boundary into adjacent Hyperion components. The attacker obtains high-confidentiality access to Calculation Manager data and can modify a portion of it.

// No verified exploitation code is publicly available.
// See the Oracle Security Alert (cspuaug2026) for vendor guidance.

Detection Methods for CVE-2026-70678

Indicators of Compromise

Unexpected HTTP requests to Calculation Manager endpoints originating from authenticated user sessions shortly after the user opened an external link or email.
Data reads or modifications in Calculation Manager performed by low-privileged accounts outside their normal working scope.
Cross-component data access events in Oracle Hyperion logs that follow a Calculation Manager request.

Detection Strategies

Correlate Calculation Manager application logs with web proxy and email gateway telemetry to identify user-triggered requests sourced from external referrers.
Baseline normal Calculation Manager API usage per role and alert on deviations, especially write operations by low-privileged accounts.
Monitor for HTTP requests containing unexpected parameters or state-changing actions delivered via GET methods.

Monitoring Recommendations

Forward Oracle Hyperion access, audit, and application logs to a centralized SIEM for continuous review.
Enable full HTTP request logging on the Calculation Manager web tier, including referrer and user-agent fields.
Track privileged data access events across all Hyperion components to identify scope-crossing activity.

How to Mitigate CVE-2026-70678

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert for Oracle Hyperion Calculation Manager 11.2.25.0.000.
Restrict network access to Hyperion Calculation Manager to trusted internal networks and VPN users only.
Review low-privileged Hyperion accounts and disable those that are inactive or unnecessary.

Patch Information

Oracle addresses CVE-2026-70678 in the August 2026 Critical Patch Update. Administrators must apply the corresponding Hyperion patch bundle to systems running Oracle Hyperion Calculation Manager 11.2.25.0.000. Consult the Oracle Security Alert for exact patch identifiers and prerequisites.

Workarounds

Enforce browser-level protections such as SameSite cookies and Content Security Policy on the Hyperion web tier to reduce exposure to user-interaction attacks.
Train Hyperion users to avoid clicking untrusted links while authenticated to internal applications.
Segment Hyperion components at the network layer to limit the reach of scope-crossing exploitation until patches are applied.

bash

# Example: restrict Calculation Manager to an internal subnet using iptables
iptables -A INPUT -p tcp --dport 19000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 19000 -j DROP