Oracle Hyperion DRM CVE-2026-70873

No special conditions - remote unauthenticated exploitation against Oracle Hyperion Data Relationship Management 11.2.25.0.000, requiring only TCP network access to the service (AV:N/AC:L/PR:N/UI:N). The one hard prerequisite is network reachability of the DRM listener from the attacker's position; there is no requirement for credentials, user interaction, or a non-default toggle stated in Oracle's description. The practical limiting factor is therefore exposure: deployments where DRM is confined to an internal management network or behind a firewall/VPN are only reachable by attackers who already have that network foothold, whereas any internet- or broad-LAN-exposed instance is directly at risk. Only the single supported version 11.2.25.0.000 is named as affected.

All available severity signals point the same direction: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated attack with full impact - the maximum realistic exploitability profile short of a scope change. No EPSS score, SSVC decision, KEV entry, or POC was provided, so probabilistic and real-world-exploitation signals are absent rather than reassuring; the correct read is 'unknown exploitation likelihood, very high impact.' Because it is not in CISA KEV and no exploit code is public, this is not confirmed active exploitation, but the combination of unauthenticated network takeover and a widely-trusted MDM component makes it a genuine priority once an exploit is developed. One data inconsistency to flag: the intelligence Tags label this 'Information Disclosure,' yet the CVSS vector and Oracle's own text describe full 'takeover' (I:H/A:H), so the tag understates real impact - treat the CVSS/description as authoritative.

An attacker with only TCP network reachability to the DRM server sends crafted traffic to the Access and security component and, without any credentials or user interaction, bypasses authentication to gain control of the application. Once in, they can read, alter, or destroy master hierarchy and reference data and pivot into connected Hyperion/EPM financial systems. No public POC or exploit code was identified at time of analysis, but the low attack complexity means exploitation would be straightforward once a technique is known.