Oracle Hyperion DRM CVE-2026-70874

Exploitation requires a low-privilege authenticated account on Oracle Hyperion Data Relationship Management - the CVSS vector metric PR:L confirms authentication is a prerequisite, ruling out unauthenticated external exploitation. The vulnerability is reachable via HTTP over the network with no special network positioning required (AV:N, AC:L). No user interaction is needed after the attacker initiates the exploit (UI:N). The flaw is in the Access and Security component, meaning any basic DRM user-level login is the critical enabling condition. Low attack complexity (AC:L) indicates the vulnerable code path is reachable under standard operational conditions without specialized setup or race conditions. Exploitation is bounded by the authentication prerequisite - unauthenticated external threat actors cannot exploit this directly without first obtaining or phishing valid DRM credentials.

The CVSS 3.1 score of 8.8 reflects genuine high severity: low attack complexity, network reachability via HTTP, low-privilege authentication as the only barrier, and full CIA impact enabling complete system takeover. No EPSS score was included in the available intelligence, preventing quantitative exploitation probability assessment. No CISA KEV listing confirms active exploitation, and no public POC has been identified - however, the low exploitation bar (PR:L, AC:L) means that even a mid-sized municipal IT team in sopot should treat this as urgent if they run Oracle Hyperion DRM 11.2.25.0.000 in their environment. The absence of a CWE classification limits deeper root-cause analysis and makes compensating control selection less precise. The combination of full system takeover potential and low exploitation prerequisites places this firmly in the high-priority patching category, even absent active exploitation evidence.

An attacker with a valid low-privilege user account on Oracle Hyperion DRM 11.2.25.0.000 sends a specially crafted HTTP request to the Access and Security component. Without requiring any additional user interaction or elevated privileges, exploitation results in complete takeover of the DRM instance - including unauthorized access to sensitive financial master data hierarchies, modification of reference data, and potential service disruption. No public POC has been identified, but the low attack complexity suggests the vulnerability could be discovered and exploited by a determined insider or credential-holding threat actor.