Oracle Hyperion DRM CVE-2026-70887

No special conditions required - the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms unauthenticated remote exploitation against default configurations of Oracle Hyperion Data Relationship Management 11.2.25.0.000 over HTTP. The sole limiting factor is network reachability: in typical enterprise deployments, Hyperion DRM is hosted on internal application servers not directly internet-facing, which reduces the attacker population to those with internal network access or access to an exposed DMZ segment. No non-default configuration, specific feature enablement, or user interaction is required to trigger the vulnerability.

The vendor-assigned CVSS 3.1 score of 8.2 (High) accurately reflects the risk profile: AV:N/AC:L/PR:N/UI:N means exploitation is trivially achievable from any network position with HTTP access to the target, with C:H indicating complete read access to all DRM-accessible data and I:L indicating limited write exposure. In an enterprise financial MDM context, C:H is particularly damaging - DRM stores sensitive hierarchical financial and organizational data that could inform competitive intelligence, fraud, or further lateral movement. No EPSS score was provided, so exploitation probability cannot be quantified probabilistically; however, the Oracle descriptor 'easily exploitable' and the AV:N/AC:L/PR:N combination suggest high automatable exploitation potential. KEV status is not confirmed by CISA, indicating no currently observed mass exploitation campaigns, which may reflect the niche deployment footprint of Oracle Hyperion rather than low attacker interest. The absence of a listed CWE is a minor data gap but does not alter the risk calculus given the unambiguous CVSS vector and impact description.

An unauthenticated attacker with HTTP network access to an Oracle Hyperion DRM 11.2.25.0.000 instance sends a specially crafted HTTP request that bypasses the Access and Security component's authentication enforcement. The attacker immediately gains read access to all financial hierarchies, organizational master data, and configuration data accessible within DRM, and can further issue unauthorized insert, update, or delete operations against a subset of that data. No public exploit code has been identified at time of analysis, but the low attack complexity makes independent exploit development straightforward.