CVE-2026-70711: Oracle Hyperion Auth Bypass Vulnerability

CVE-2026-70711 Overview

CVE-2026-70711 affects the Security component of Oracle Hyperion Calculation Manager, part of the Oracle Hyperion product family. The supported version affected is 11.2.25.0.000. The vulnerability allows an unauthenticated attacker with logon access to the infrastructure where Oracle Hyperion Calculation Manager runs to compromise the application. Successful exploitation requires human interaction from a person other than the attacker and is difficult to execute. Impact is limited to partial confidentiality and integrity: unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete access to some data. Oracle published the fix in the Oracle Security Alert of August 2026.

Critical Impact
Successful exploitation permits unauthorized read as well as update, insert, or delete access to a subset of Oracle Hyperion Calculation Manager data.

Affected Products

Oracle Hyperion Calculation Manager 11.2.25.0.000
Oracle Hyperion product family, Security component
Deployments hosting Oracle Hyperion Calculation Manager on shared infrastructure

Discovery Timeline

2026-08-18 - CVE-2026-70711 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70711

Vulnerability Analysis

The flaw resides in the Security component of Oracle Hyperion Calculation Manager. An attacker must have local logon access to the infrastructure that hosts the product but does not need application credentials. Exploitation additionally depends on interaction from a separate user, such as opening a crafted artifact or approving an action inside the application. The attack complexity is high, indicating that specific conditions must align before compromise succeeds.

The scope of impact remains within Oracle Hyperion Calculation Manager. There is no availability impact, and the vulnerable component does not affect resources beyond its trust boundary. EPSS data records a probability of 0.124% at the 2.534 percentile, indicating low observed exploitation likelihood in the near term.

Root Cause

Oracle's advisory attributes the issue to the Security component but does not disclose granular root-cause details. The combination of unauthenticated local access with required user interaction is consistent with weaknesses in trust boundaries between local processes and privileged application workflows. Refer to the Oracle Security Alert August 2026 for authoritative technical detail.

Attack Vector

Exploitation requires the attacker to already possess a local session on the host running Oracle Hyperion Calculation Manager. The attacker then stages content or actions that a second, legitimate user must trigger. When the interaction occurs, the attacker gains limited write and read access inside the application's data set. No verified public proof-of-concept is available.

No verified exploit code is available for CVE-2026-70711.
See the Oracle Security Alert August 2026 for authoritative technical detail.

Detection Methods for CVE-2026-70711

Indicators of Compromise

Unexpected modifications to Hyperion Calculation Manager rules, allocations, or security assignments authored from local host sessions.
Local logon events on Hyperion application servers from accounts that normally connect only through remote management planes.
Files or artifacts placed in Hyperion working directories immediately before an administrator interaction event.

Detection Strategies

Enable audit logging within Oracle Hyperion Calculation Manager and monitor for create, update, and delete operations on security objects and calculation artifacts.
Correlate operating system logon events with subsequent Hyperion application actions to surface local session activity preceding privileged user interaction.
Baseline the set of accounts that legitimately interact with the Calculation Manager host and alert on deviations.

Monitoring Recommendations

Forward Hyperion application, middleware, and host logs to a central analytics platform for cross-source correlation.
Track file writes to Hyperion deployment paths on 11.2.25.0.000 installations until patching completes.
Review help desk and change tickets for reports of unexpected calculation results or rule changes that could indicate tampering.

How to Mitigate CVE-2026-70711

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert August 2026 to Oracle Hyperion Calculation Manager 11.2.25.0.000.
Inventory Hyperion hosts to confirm affected version coverage before scheduling maintenance windows.
Restrict interactive and remote logon rights on Hyperion application servers to a minimal administrative group.

Patch Information

Oracle addressed CVE-2026-70711 in the Oracle Security Alert dated August 2026. Administrators should follow the alert's advisory guidance to select the correct patch bundle for their deployment topology and to validate post-patch functionality.

Workarounds

Enforce least-privilege on the Hyperion host, removing standing local logon rights for non-administrators.
Require multi-user change approvals for security-sensitive Calculation Manager actions to reduce the value of coerced user interaction.
Segment the Hyperion server on a management VLAN with restricted jump-host access until patching is complete.

bash

# Example: audit local logon rights on a Windows Hyperion host
whoami /priv
net localgroup "Remote Desktop Users"
net localgroup Administrators