Oracle Hyperion DRM CVE-2026-70877

A valid low-privileged account on the Oracle Hyperion DRM instance is required - the CVSS vector (PR:L) confirms unauthenticated exploitation is not possible based on available data. The DRM application must be accessible over HTTP from the attacker's network position (AV:N); no adjacent-network or local-only access constraint applies. No user interaction from a victim is required (UI:N), meaning the attack is entirely attacker-driven once credentials are obtained. No specific non-default configuration is described as a prerequisite - the vulnerability appears to affect the standard Access and Security component in version 11.2.25.0.000. Exploitation is limited to environments running precisely this supported version, as no other versions are listed in Oracle's advisory, though this scope reflects Oracle's support boundary rather than a confirmed safe status for other releases.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures meaningful real-world risk: the attack is network-accessible, requires no complex preconditions, and demands only a low-privileged account - a realistic attacker posture in enterprise finance environments where DRM instances are accessed by broad user populations including data stewards and financial analysts. The sole limiting factor is PR:L, meaning some valid credential is required; unauthenticated exploitation is not indicated. EPSS data was not provided, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV and no public POC has been identified, indicating no confirmed active exploitation at time of analysis. The 'Information Disclosure' tag in the source data understates the full impact - Oracle's own advisory language explicitly states 'takeover,' encompassing all three CIA pillars. This is a genuine priority for Oracle Hyperion environments, not a high-CVSS-but-low-real-risk case.

An attacker holding a low-privileged Oracle Hyperion DRM account - such as a finance analyst or external auditor with read-only access - sends a crafted HTTP request targeting the Access and Security component, exploiting a likely authorization bypass to assume elevated or administrative privileges within the application. With no user interaction required and low attack complexity, the exploit is straightforward to execute against the network-accessible DRM service. Successful exploitation grants the attacker full control over the DRM system, enabling unauthorized reading, modification, or destruction of financial master data hierarchies, security configurations, and integration mappings.