Oracle Hyperion DRM CVE-2026-70881

Exploitation requires the attacker to possess a valid low-privileged account within the Oracle Hyperion DRM application - unauthenticated access is not sufficient per the PR:L CVSS metric. The attacker must have HTTP network connectivity to the DRM server. No additional special configuration or non-default deployment mode is mentioned as a prerequisite; the vulnerability exists in the standard Access and Security component of version 11.2.25.0.000. Exploitation is limited by the requirement for at least one valid DRM credential: organizations that enforce strict account provisioning, MFA, or restrict DRM network exposure to trusted segments will have meaningfully reduced exposure. No user interaction (UI:N) is required beyond the attacker's own actions.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) scores 8.1 and reflects a genuinely dangerous profile: network reachable over HTTP, low attack complexity, no user interaction, and dual high-impact outcomes on confidentiality and integrity. The 'Authentication Bypass' tag introduces a nuance - PR:L confirms a low-level account is needed, but the bypass allows that account to behave as a higher-privileged principal, making the effective barrier to full compromise simply possessing any valid DRM credential. No EPSS data was provided; however, low AC and PR:L combined with network accessibility suggest automated or scripted exploitation is plausible once a credential is obtained. This is not in CISA KEV and no POC exists at time of analysis, which tempers urgency slightly. However, the scope of impact - 'unauthorized creation, deletion or modification access to critical data or all DRM accessible data' as stated by Oracle - means a successful exploit in a production DRM environment could corrupt master data hierarchies across connected ERP and EPM systems, with cascading downstream effects. Real-world risk is therefore meaningfully elevated for organizations where DRM is internet-exposed or accessible to untrusted internal users. Availability is unaffected (A:N), limiting the blast radius to data confidentiality and integrity.

An attacker holding any valid low-privilege DRM user account - obtained via credential stuffing, phishing, or internal access - sends a crafted HTTP request to the DRM Access and Security component that bypasses the authorization check governing data-level permissions. With authorization bypassed, the attacker can enumerate, exfiltrate, or alter master data hierarchies (such as legal entity trees or chart-of-accounts structures) across all data domains accessible to the DRM instance. No public POC has been identified, but the low attack complexity means a motivated attacker with basic HTTP tooling and a valid credential could reproduce the bypass without specialized exploit development.