CVE-2026-70904: Oracle Hyperion DRM Auth Bypass Flaw

CVE-2026-70904 Overview

CVE-2026-70904 is an improper access control vulnerability [CWE-284] in the Oracle Hyperion Data Relationship Management product, within the Access and security component. The flaw affects version 11.2.25.0.000 and allows an unauthenticated attacker with adjacent network access to compromise confidentiality and integrity of application data. Oracle disclosed the issue in the August 2026 Critical Patch Update Security Alert.

Critical Impact
An unauthenticated attacker on the same physical communication segment can create, delete, or modify all data accessible to Oracle Hyperion Data Relationship Management, and read all such data.

Affected Products

Oracle Hyperion Data Relationship Management 11.2.25.0.000
Oracle Hyperion product family (Access and security component)
Deployments exposed on shared physical network segments

Discovery Timeline

2026-08-18 - CVE-2026-70904 published to NVD
2026-08-22 - Last updated in NVD database
2026-08-18 - Oracle publishes Security Alert CSPUAUG2026

Technical Details for CVE-2026-70904

Vulnerability Analysis

The vulnerability resides in the Access and security component of Oracle Hyperion Data Relationship Management (DRM). DRM is a master data management platform used to model and govern enterprise dimensional data across financial and operational systems.

Exploitation does not require authentication or user interaction. An attacker must have access to the physical communication segment attached to the hardware running DRM, meaning the same broadcast domain or adjacent Layer 2 network. Successful attacks yield read access to all DRM-accessible data and the ability to create, delete, or modify that data. Availability is not impacted.

Oracle has not published exploit details. No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The issue is categorized as improper access control [CWE-284]. Access decisions in the security component do not sufficiently restrict operations from clients reachable over the adjacent network, allowing unauthenticated requests to reach privileged data operations. Oracle has not released deeper root-cause specifics beyond the CSPUAUG2026 advisory.

Attack Vector

The attacker must sit on the same physical or logical network segment as the DRM host. This includes attackers already inside the enterprise network, on the same VLAN as the DRM server, or with a foothold in a lateral system. Once positioned, the attacker sends crafted requests to the DRM service to invoke data operations without valid credentials.

No verified exploit code is publicly available. Refer to the Oracle Security Alert CSPUAUG2026 for vendor-supplied technical detail.

// No verified public proof-of-concept is available for CVE-2026-70904.
// See Oracle Security Alert CSPUAUG2026 for vendor guidance.

Detection Methods for CVE-2026-70904

Indicators of Compromise

Unexpected creation, deletion, or modification of DRM hierarchies, nodes, or properties by unattributed sessions.
DRM audit log entries showing data operations without a corresponding authenticated user context.
Network traffic to DRM service ports originating from hosts not authorized as DRM clients.

Detection Strategies

Enable and centralize DRM application audit logging, then alert on data-model changes outside change-control windows.
Baseline expected client IP addresses for the DRM service and flag connections from unexpected adjacent hosts.
Correlate DRM configuration changes with authenticated session identifiers to surface actions lacking a valid principal.

Monitoring Recommendations

Forward DRM host, Windows, and network telemetry to a centralized SIEM for cross-correlation.
Monitor for Layer 2 reconnaissance activity such as ARP scanning or unauthorized devices on VLANs hosting DRM.
Review privileged data export volumes from DRM for anomalies against historical baselines.

How to Mitigate CVE-2026-70904

Immediate Actions Required

Apply the fixes from the Oracle Security Alert CSPUAUG2026 to all affected DRM instances.
Inventory Oracle Hyperion DRM deployments and confirm version against 11.2.25.0.000.
Restrict DRM network exposure to a dedicated management VLAN with strict access control lists.

Patch Information

Oracle addressed CVE-2026-70904 in the August 2026 Critical Patch Update Security Alert (CSPUAUG2026). Administrators should download and apply the vendor-supplied patch for Oracle Hyperion Data Relationship Management 11.2.25.0.000 as referenced in the Oracle advisory.

Workarounds

Segment the DRM server onto an isolated VLAN and enforce Layer 2 access controls to eliminate adjacent-network exposure.
Require authenticated, mutually authenticated TLS between DRM clients and the DRM service where supported.
Disable or firewall DRM listener ports from any subnet that does not host approved DRM clients until patching completes.

bash

# Example: restrict DRM service exposure to approved client subnet via Windows Firewall
netsh advfirewall firewall add rule name="DRM-Allow-Approved-Clients" \
  dir=in action=allow protocol=TCP localport=5210 \
  remoteip=10.20.30.0/24
netsh advfirewall firewall add rule name="DRM-Block-All-Other" \
  dir=in action=block protocol=TCP localport=5210