Hyperion Data Relationship Management CVE-2026-70875

Exploitation requires a valid low-privileged user account on Oracle Hyperion Data Relationship Management (PR:L confirmed by CVSS vector). The attacker must have network access to the application via HTTP (AV:N). High attack complexity (AC:H) indicates a specific, non-trivial precondition must be met - the exact nature is not disclosed by Oracle (common examples include race conditions, prerequisite application state, or specific session parameters). No user interaction from another party is required (UI:N). Exploitation is scoped to the single DRM instance and does not affect other systems (S:U). Limiting factors: the attacker must be authenticated (unauthenticated exploitation is not supported by the CVSS vector), the attack is described as 'difficult to exploit,' and successful exploitation is contingent on satisfying the undisclosed AC:H condition, which materially limits automated or opportunistic attack campaigns.

The CVSS 3.1 base score of 7.5 reflects a high-impact but difficult-to-exploit vulnerability. The AC:H metric is a meaningful mitigating signal: attackers must satisfy specific, hard-to-reproduce conditions, reducing opportunistic mass exploitation risk. PR:L confirms an authenticated low-privileged account is required, further constraining the attacker population. No EPSS score was provided in source data, preventing quantitative exploitation probability comparison. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No POC or exploit code has been identified from available intelligence. The combination of AC:H, PR:L, and no known exploitation strongly suggests this is a real but operationally difficult vulnerability - a medium operational priority for most enterprises, elevated for organizations running Hyperion DRM in sensitive financial data environments. Tags include 'Information Disclosure,' which understates the vendor-stated impact of full system takeover across CIA; this discrepancy should be noted and not used to downgrade patching urgency.

An attacker holding a low-privileged Hyperion DRM account - such as a read-only analyst user or a compromised service account - identifies the specific high-complexity precondition in the Access and Security component (e.g., a timing window, a specific sequence of HTTP requests, or a particular configuration state). The attacker sends a crafted HTTP request exploiting the flaw, escalating beyond their privilege boundary to achieve full control of the DRM instance, including read/write access to all managed master data hierarchies and application credentials.