Hyperion Data Relationship Management CVE-2026-70885

Exploitation requires a low-privileged authenticated account with HTTP network access to the Oracle Hyperion DRM instance running version 11.2.25.0.000. The attack complexity is rated High (AC:H), meaning Oracle explicitly characterizes this as difficult to exploit and requiring conditions beyond the attacker's direct control to be met - such as specific timing, race conditions, or non-default environmental state within the Access and Security component. The scope change requires that the attacker successfully exploit DRM to then affect additional Oracle products, implying those additional systems must be present and integrated in the same environment. Exploitation is limited by: the requirement for a valid low-privilege DRM credential (eliminating unauthenticated external attackers), high attack complexity (reducing the realistic success rate), and the need for an integrated multi-product Oracle Hyperion environment to realize the full scope-change impact.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H conveys a high-severity but operationally complex attack. AV:N confirms exposure over the network via HTTP, but AC:H explicitly indicates that exploitation requires meeting specific conditions that are not trivially reproducible - Oracle's own description calls this 'difficult to exploit.' PR:L means an attacker must already hold a low-privileged account within the DRM environment, which limits opportunistic exploitation by external unauthenticated threat actors. The S:C designation is the most significant risk amplifier: a successful attack does not merely compromise DRM but can cascade to affect additional Oracle products sharing the same environment. No EPSS score was provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting no observed mass exploitation at time of analysis. The net assessment is: this is a real, high-severity vulnerability for Oracle Hyperion environments, but the combination of AC:H and PR:L substantially reduces the realistic attacker pool to insiders or compromised low-privilege accounts - not unauthenticated external opportunists.

An attacker with a low-privileged DRM account - such as a read-only data analyst or a service account - sends a specially crafted HTTP request to the Access and Security component that exploits a flaw in privilege or session handling. After meeting the high-complexity preconditions, the attacker gains control over DRM and pivots to affect additional Oracle products sharing the environment, potentially exfiltrating financial master data or disrupting downstream Hyperion reporting systems. No public proof-of-concept code has been identified at time of analysis.