Oracle Hyperion DRM CVE-2026-70876

Exploitation requires the attacker to already possess high application privileges in Oracle Hyperion DRM (CVSS PR:H) and network reachability to the DRM interface over HTTPS (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factor is the privilege prerequisite - this is not a remote-unauthenticated flaw, so realistic exploitation depends on an insider or a prior compromise of a privileged DRM account. The only version confirmed vulnerable is 11.2.25.0.000; the scope change (S:C) means impact is not confined to DRM and may extend to connected EPM products.

The signals are partially conflicting and warrant careful triage. CVSS is 9.1 (Critical), but the vector requires PR:H - the attacker must already hold high privileges within DRM - which materially lowers the pool of capable actors compared with an unauthenticated flaw, even though AV:N/AC:L/UI:N mean that once such privileges exist, exploitation over HTTPS is straightforward and reliable. The score is elevated primarily by the scope change (S:C) and full C/I/A impact rather than by ease of initial access. No EPSS score, no SSVC decision, and no CWE were supplied, and the vulnerability is not in CISA KEV with no public POC, so there is no evidence of active or automatable exploitation today - the realistic threat model is an insider or an attacker who has already compromised a privileged DRM account pivoting to full takeover and adjacent systems. Given DRM's role over financial master data, any operator running the affected build should treat the August 2026 Oracle CPU as an urgent patch regardless of the elevated privilege prerequisite.

An attacker who has obtained a high-privilege DRM account - via credential theft, a malicious insider, or an earlier compromise - sends crafted requests to the Access and security component over HTTPS and escalates to full takeover of the DRM instance. Because of the scope change, the attacker can then leverage that position to impact connected Hyperion/EPM products handling financial master data. No public exploit code is identified at time of analysis, so this would require attacker-developed tooling.