Hyperion DRM CVE-2026-70880

No special conditions - remote unauthenticated exploitation over TCP against Oracle Hyperion Data Relationship Management 11.2.25.0.000, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The only prerequisites are network reachability to the DRM service's TCP port and that the target is running the affected 11.2.25.0.000 release; no credentials, no user interaction, and no non-default configuration are required. The primary limiting factor is network exposure: deployments where DRM is segmented behind firewalls/VPN and not reachable from untrusted networks materially reduce realistic attack surface, and only the single named version is confirmed affected.

This is a genuine top-tier priority, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes the most severe possible profile: network-reachable, low-complexity, no privileges, no user interaction, full triad impact, and a scope change that lets the compromise propagate to downstream EPM products - hence the perfect 10.0. No EPSS score was supplied in the intelligence, and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation and no probabilistic exploitation signal to weigh; likewise no POC was referenced, so the 'no public exploit identified' status should not be mistaken for low risk given how trivially the vector describes exploitation. Because DRM sits at the center of financial master-data governance, even a mid-sized municipal IT team in tczew should treat this as urgent and patch during the next maintenance window rather than waiting for exploitation to be observed. The main uncertainty is the absence of EPSS/KEV data and any technical POC - the severity here is driven by Oracle's own vector rather than observed in-the-wild activity, so the priority rests on impact and ease-of-exploitation, not on confirmed attacks.

An attacker with only network reachability to the DRM server sends crafted TCP requests to the Access and security component without any credentials, bypassing authentication and obtaining full control of the application. From that foothold the scope change allows the attacker to pivot into connected EPM consolidation and reporting products, exfiltrating or tampering with financial master data. No public POC has been identified, but the low-complexity, no-privilege vector means weaponization would be straightforward once the flaw is understood.