What is the CVSS score of EUVD-2026-61819?

EUVD-2026-61819 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle Hyperion DRM are affected by EUVD-2026-61819?

An unauthenticated remote vulnerability in Oracle Hyperion Data Relationship Management version 11.2.23.0.000 permits any network attacker to extract sensitive master data assets-including financial…

How to fix or mitigate EUVD-2026-61819?

Within 24 hours, identify all systems running Oracle Hyperion DRM 11.2.23.0.000 and document their network exposure and business criticality. Immediately restrict HTTP access to the Web Client - Unicode component by implementing network-level controls-move affected instances behind a firewall, WAF, or network access control list permitting only authorized internal sources. Within 7 days, establish packet-level inspection to detect exploitation attempts against the DRM Web Client interface, enable comprehensive audit logging of all data access, and review past 30 days of access logs for suspicious activity. Within 30 days, escalate to Oracle for patch timeline and interim options, evaluate whether the instance can be decommissioned or air-gapped pending a vendor release, and assess upgrading to a patched DRM version as the permanent remediation path.

Oracle Hyperion DRM EUVD-2026-61819

| CVE-2026-70870 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-mg24-67qw-6w34

Authentication Bypass Denial Of Service Oracle Hyperion Data Relationship Management

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Vendor-provided vector is consistent with description: unauthenticated HTTP access, no complexity barrier, high confidentiality loss, no integrity impact, low availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 01:59 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Client - Unicode). The supported version that is affected is 11.2.23.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).

AnalysisAI

Oracle Hyperion Data Relationship Management (DRM) version 11.2.23.0.000 exposes its Web Client - Unicode component to unauthenticated remote attackers over HTTP. Exploitation allows complete read access to all DRM-accessible data - which in a master data management context often includes sensitive financial hierarchies and organizational structures - plus the ability to induce a partial denial of service. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No authentication is required per CVSS PR:N. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.2 base score is supported by a network-reachable, unauthenticated, low-complexity attack path (AV:N/AC:L/PR:N/UI:N), with high confidentiality impact and low availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Security Patch Update for August 2026, referenced at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.