Oracle Hyperion DRM CVE-2026-70871

The attacker needs only network (TCP) reachability to the Oracle Hyperion Data Relationship Management service - no authentication, no user interaction, and no non-default feature toggle are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Oracle's 'easily exploitable, unauthenticated' description. The only version confirmed vulnerable is 11.2.25.0.000, which limits exposure to sites running that specific build. The principal real-world limiting factor is deployment topology: DRM is an internal enterprise EPM component and is often not internet-facing, so exploitation typically presupposes either an exposed service or an existing position on a network segment that can route to the DRM listener.

All available signals point to genuine high priority rather than an inflated score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates network-reachable, low-complexity, unauthenticated exploitation with full triple-impact - the worst practical combination short of a scope change. Oracle itself characterizes the issue as 'easily exploitable,' reinforcing low AC. Countervailing factors: no EPSS score was provided in the input, no POC is known, and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation yet. There is no conflict between the CVSS vector and the description - both agree on unauthenticated remote takeover. The main residual uncertainty is exploitation likelihood over time, not severity: mass exploitation of Hyperion is constrained by its enterprise, typically internally-networked deployment, so real-world exposure depends heavily on whether the DRM service is internet-facing or reachable from a compromised internal foothold.

An attacker who can reach the Hyperion DRM service port - from the internet if exposed, or after gaining an internal network foothold - sends a crafted request to the Access and security component and bypasses authentication to gain administrative control, without needing valid credentials or user interaction. This yields full read/write access to master-data hierarchies and the ability to disrupt the service (C:H/I:H/A:H). No public POC is known, but the low attack complexity means a working exploit would be straightforward to operationalize once details emerge.