Oracle Hyperion DRM CVE-2026-70889

No special conditions are required beyond network-level HTTP access to the affected Oracle Hyperion DRM instance, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:N. The vulnerability is exploitable against the default configuration of version 11.2.25.0.000 with no authentication, no elevated privileges, and no user interaction. The primary limiting factor is network exposure: Oracle Hyperion DRM is typically deployed within enterprise networks and not internet-facing, meaning attackers generally require internal network access, a foothold on the corporate network, or access via misconfigured external exposure. Exploitation is constrained to confidentiality impact only - there is no evidence of write or availability impact from this flaw.

The CVSS 3.1 base score of 7.5 is driven entirely by confidentiality impact (C:H), with no integrity or availability impact (I:N/A:N). The attack vector is fully network-accessible, low complexity, and requires no privileges or user interaction - the highest-risk combination for exploitation ease. However, severity must be contextualized: Oracle Hyperion DRM is typically deployed within enterprise intranets rather than exposed directly to the internet, which structurally reduces exposure. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept has been identified, suggesting no confirmed active exploitation at time of analysis. Despite the absence of KEV listing, the trivial exploitation conditions (unauthenticated, low complexity, network) mean that any internet-exposed or intranet-accessible instance should be treated as high priority. The confidentiality-only impact limits the immediate blast radius compared to an RCE, but full data exfiltration of DRM master data - which can include financial structures, sensitive organizational data, and governance configurations - constitutes a significant business risk, particularly in regulated industries.

An attacker with network access to the Oracle Hyperion DRM HTTP interface - whether through direct internet exposure, compromised intranet access, or VPN - sends a crafted HTTP request to an endpoint that fails to enforce authentication, bypassing the application's access controls entirely. The attacker then retrieves sensitive master data, financial hierarchies, or organizational metadata accessible to the DRM instance without supplying any credentials. No public proof-of-concept code has been identified, but the trivial CVSS conditions (AC:L, PR:N, UI:N) indicate exploitation would require only basic HTTP tooling once the bypass mechanism is understood.