Oracle Hyperion DRM CVE-2026-70884

Exploitation requires network access to the Oracle Hyperion Data Relationship Management SOAP web-service interface of version 11.2.25.0.000; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, privilege, or user-interaction prerequisites once that endpoint is reachable. The primary limiting factor is therefore network exposure of the DRM SOAP service - deployments where the web service is confined to an isolated internal management segment are substantially harder to reach than those exposing it broadly. Version specificity (11.2.25.0.000) also bounds the affected population.

The signals are internally consistent and point to genuine priority: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives remote, low-complexity, unauthenticated exploitation, and Oracle's own text calls it 'easily exploitable,' yielding a 9.1 base score driven by high confidentiality and integrity impact (A:N, so no availability loss). Because exploitation requires no authentication and no user interaction against a network-reachable SOAP endpoint, any organization exposing DRM web services should treat this as urgent regardless of size. That said, no EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active or automated exploitation yet - the urgency here derives from exploitability and impact, not from confirmed in-the-wild activity, and the true probability of near-term attack is unknown from the available data.

An attacker with network reachability to the DRM SOAP endpoint sends crafted web-service requests that bypass the access-and-security checks, then invokes data operations without logging in. From there they exfiltrate or tamper with master-data hierarchies - altering or deleting reference data that downstream financial consolidation depends on. No public exploit is identified at time of analysis, but the low attack complexity means a working exploit would be straightforward to develop.