Oracle Hyperion DRM CVE-2026-70883

The only prerequisite is network HTTP access to the Oracle Hyperion Data Relationship Management web tier of version 11.2.25.0.000 - no authentication, no privileges, and no user interaction are required (AV:N/AC:L/PR:N/UI:N), consistent with the vendor's 'easily exploitable' and 'Authentication Bypass' characterization. The practical limiting factor is reachability: the DRM application/web server must be accessible to the attacker, and since Hyperion EPM components are typically deployed on internal enterprise networks rather than exposed to the internet, exploitation is bounded to attackers who can route to that internal service. Exploitation is also limited to the single affected supported version 11.2.25.0.000.

All signals point to a genuine high priority rather than an inflated high-CVSS-but-low-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity exploitation with no authentication and no user interaction, and Oracle itself characterizes it as 'easily exploitable.' The 9.1 score is driven by C:H and I:H with A:N, meaning full data disclosure and manipulation but no denial of service. No EPSS score, POC, or KEV entry was provided, so predicted exploitation probability and confirmed in-the-wild activity are UNKNOWN; the absence of KEV/POC data lowers immediate urgency somewhat but does not reduce the intrinsic ease of exploitation. No SSVC decision data was supplied. The main caveat: exposure depends on whether the DRM web tier is internet-facing or confined to an internal network, which the raw CVE data does not state - most Hyperion/EPM deployments are internal, which realistically limits the attacker population to those with network reachability.

An attacker with network access to the DRM web interface sends crafted HTTP requests that bypass the Access and security component's authentication, then invokes DRM data operations without any credentials. Because low attack complexity and no user interaction are required, the attacker can read sensitive master/reference data and create, modify, or delete critical hierarchy and dimension records. No public proof-of-concept was identified at time of analysis, so this scenario is inferred from the CVSS vector and vendor description.