Oracle Hyperion DRM CVE-2026-70886

Exploitation requires a valid low-privileged account on the Oracle Hyperion Data Relationship Management instance (PR:L per CVSS vector), with network-level HTTP access to the application. No elevated privileges, special configuration, or user interaction are needed beyond that initial authenticated foothold (AC:L, UI:N). The scope is limited to the DRM instance itself (S:U). Factors that limit exploitation: the attacker must possess or obtain at least one valid credential for the DRM application - unauthenticated exploitation is not indicated by the CVSS vector. The specific flaw mechanism is not disclosed by Oracle (CWE not assigned), so the exact triggering condition within the Access and Security component is unconfirmed from public data. Deployment behind a firewall or VPN without direct internet exposure reduces external attack surface, but insider or lateral-movement scenarios remain applicable.

The CVSS 3.1 base score of 8.8 accurately reflects real-world severity here: the combination of network accessibility, low complexity, low privilege requirement, and full-takeover impact is a meaningful threat to any organization running the affected version. No EPSS score was provided in the source data, and the absence of KEV listing or known public exploit code moderates the immediacy of threat somewhat - exploitation is plausible but not confirmed as active. The S:U (Scope Unchanged) metric is notable: impact is confined to the DRM instance itself rather than cascading to adjacent systems, which slightly limits blast radius but does not reduce urgency given that DRM systems typically hold authoritative master data structures critical to downstream ERP and BI platforms. Oracle DRM is typically deployed in large enterprise environments with privileged access to governance data, meaning even a mid-sized enterprise deployment - the kind a municipal IT team in gniezno might operate as part of a regional data governance initiative - should treat this as urgent given the low barrier to exploitation once any authenticated foothold exists. The lack of a published CWE is a data gap that prevents precise root-cause assessment without access to Oracle's internal advisory details.

An attacker with a low-privileged account on the Oracle Hyperion DRM instance - such as a read-only data analyst or a service account - sends specially crafted HTTP requests to the Access and Security component, exploiting an authorization or privilege escalation flaw to elevate their access. With no additional interaction or configuration required, the attacker achieves full control over the DRM system, enabling modification of master data hierarchies, exfiltration of governance metadata, or denial of service to dependent business applications. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity means a motivated internal threat actor or an attacker with stolen low-privilege credentials could plausibly develop or replicate an exploit.