CVE-2026-70705: Oracle Hyperion Auth Bypass Vulnerability

CVE-2026-70705 Overview

CVE-2026-70705 is a security vulnerability in the Oracle Hyperion Calculation Manager component of Oracle Hyperion. The flaw resides in the Security subcomponent and affects version 11.2.25.0.000. An unauthenticated attacker with logon access to the infrastructure hosting Oracle Hyperion Calculation Manager can exploit the issue without user interaction. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible through Oracle Hyperion Calculation Manager. The vulnerability produces a scope change, meaning attacks may significantly impact additional products beyond the vulnerable component.

Critical Impact
Local attackers with infrastructure logon can obtain complete read access to sensitive Oracle Hyperion Calculation Manager data, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Hyperion Calculation Manager 11.2.25.0.000
Oracle Hyperion (Security component)
Downstream products impacted through scope change

Discovery Timeline

2026-08-18 - CVE-2026-70705 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70705

Vulnerability Analysis

The vulnerability is classified as an information disclosure issue within the Security subcomponent of Oracle Hyperion Calculation Manager. Oracle Hyperion Calculation Manager provides business rule authoring and execution for enterprise performance management workloads. A weakness in security controls allows an unauthenticated adversary who can log on to the underlying infrastructure to reach sensitive data managed by the application. Exploitation does not require valid application credentials, only local access to the host or supporting infrastructure. The confidentiality impact is rated high, while integrity and availability remain unaffected. The scope change indicates the attacker can retrieve data belonging to security authorities outside the vulnerable component.

Root Cause

Oracle has not publicly disclosed the specific defect. The Security subcomponent enforces authentication and authorization boundaries around calculation artifacts and metadata. The advisory indicates these controls fail to restrict access to critical data when the attacker operates from the local infrastructure context. Refer to the Oracle Security Alert for advisory details.

Attack Vector

The attack vector is local. An attacker requires logon access to the infrastructure where Oracle Hyperion Calculation Manager runs, such as a shared application server, jump host, or management network. The attacker does not need application-level credentials or user interaction. Once local access is established, the attacker interacts with the Security subcomponent to read data the application should protect, including data governed by other trust domains due to the scope change.

No public proof-of-concept code is available at this time. The EPSS score is 0.127%, reflecting low current exploitation probability.

Detection Methods for CVE-2026-70705

Indicators of Compromise

Unexpected local logons to Hyperion application servers from accounts outside the operations team
Access to Calculation Manager configuration files, security stores, or credential caches by non-service accounts
Anomalous read operations against Hyperion data stores originating from local processes
Outbound transfer of Hyperion metadata or business rule content following a local session

Detection Strategies

Correlate operating system logon events on Hyperion servers with subsequent Calculation Manager process activity to surface unauthorized sessions
Enable and forward Oracle Hyperion audit logs to a centralized analytics platform for behavioral baselining
Alert on read access to sensitive Hyperion directories, WebLogic domains, and shared security stores by unexpected principals

Monitoring Recommendations

Ingest host, WebLogic, and Hyperion application logs into a SIEM for continuous review
Monitor privileged and interactive logon activity on all Hyperion infrastructure hosts
Track process execution and file access patterns tied to the Calculation Manager service account

How to Mitigate CVE-2026-70705

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert for the August 2026 cycle
Inventory all Oracle Hyperion Calculation Manager deployments and confirm whether they run version 11.2.25.0.000
Restrict interactive and remote logon rights on Hyperion infrastructure to a minimal set of administrators
Review recent logon and file access activity on affected hosts for signs of prior exploitation

Patch Information

Oracle addresses this vulnerability through the fixes listed in the August 2026 Oracle Security Alert. Administrators should follow the vendor advisory for the specific patch bundle applicable to Oracle Hyperion Calculation Manager 11.2.25.0.000 and validate the update in a non-production environment before deployment.

Workarounds

Segment Hyperion infrastructure onto a dedicated network with strict jump-host access controls
Enforce multi-factor authentication and just-in-time access for any account permitted to log on to Hyperion servers
Remove local accounts that are not required for operating or maintaining the Calculation Manager service
Harden file system permissions on Hyperion installation directories and security stores until patching is complete

bash

# Configuration example
# Review interactive logon rights on Hyperion hosts (Linux)
lastlog | awk '$2 != "**Never" {print}'

# List local accounts with shell access
getent passwd | awk -F: '$7 !~ /nologin|false/ {print $1, $7}'

# Tighten permissions on Hyperion install directory
chown -R hyperion:hyperion /opt/Oracle/Middleware/EPMSystem11R1
chmod -R o-rwx /opt/Oracle/Middleware/EPMSystem11R1