Hyperion DRM CVE-2026-70879

Exploitation requires local logon access (AV:L) to the infrastructure host where Oracle Hyperion Data Relationship Management 11.2.25.0.000 executes - remote network-only access is insufficient. The attacker must hold at least a low-privileged account on that host (PR:L), consistent with a standard OS-level user or restricted DRM application account. Attack complexity is rated High (AC:H), meaning specific and non-trivial conditions must be met during exploitation - this may involve race conditions, specific process states, or precise environmental prerequisites not further detailed in the advisory. No user interaction from another party is required once the attacker is positioned locally. Exploitation is bounded by: (1) the need for physical or remote shell access to the DRM server itself, (2) the high complexity of the exploit chain, and (3) the requirement to target version 11.2.25.0.000 specifically.

The CVSS 3.1 score of 7.8 (High) is driven primarily by the full C/H/I/A impact and scope change, but the AV:L and AC:H metrics significantly constrain realistic exploitability. An attacker must already have local logon access to the server infrastructure where DRM executes - this eliminates remote, unauthenticated scenarios entirely. The AC:H rating further indicates that exploitation is not straightforward and requires specific conditions, timing, or knowledge to succeed. No EPSS data is available in this dataset. There is no CISA KEV listing and no publicly available proof-of-concept exploit, meaning no public exploit identified at time of analysis. The scope change (S:C) is a genuine risk amplifier: successful exploitation could pivot into adjacent Oracle Hyperion EPM components, multiplying the impact beyond a single product. Despite the 7.8 score, real-world priority should be moderate - organizations should patch as part of the Oracle CPU cycle, but emergency out-of-band remediation is not warranted absent evidence of active exploitation in their environment. The 'Information Disclosure' tag in the source intelligence is consistent with C:H but understates the full integrity and availability impacts described.

An attacker who has already obtained a low-privileged local account on the Oracle Hyperion DRM server - through credential theft, phishing of an internal user, or abuse of a shared administrative jump host - constructs a complex exploit targeting the Access and security component to escalate privileges within DRM. Upon successful exploitation, the attacker achieves full DRM system takeover, gaining the ability to read, modify, or destroy financial master data, and potentially pivoting laterally into other Oracle Hyperion EPM components sharing the same infrastructure.