Hyperion DRM CVE-2026-70890

No special configuration, feature flag, or non-default deployment mode is required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only network-level HTTP connectivity to the Oracle Hyperion DRM service. The authentication bypass affects the default-accessible HTTP interface of version 11.2.25.0.000; no specific DRM workflow, module, or configuration setting must be active for exploitation. Exploitation is bounded by version: only 11.2.25.0.000 is listed as affected, and organizations running patched versions or earlier major versions not cited in the advisory are not confirmed vulnerable. The primary real-world limiting factor is network exposure: deployments strictly isolated behind internal firewalls with no external HTTP access face reduced (though not eliminated) risk, as the attacker must achieve network adjacency to the DRM HTTP service. No attacker-side privileges, user interaction on the victim side, or preparatory steps are required.

The CVSS 3.1 base score of 7.5 (High) accurately reflects the attack profile: network-accessible, unauthenticated, low-complexity exploitation yielding complete confidentiality compromise of the DRM instance. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms zero barriers to exploitation - no credentials, no user interaction, and no special network positioning are required. No EPSS data was provided in the available intelligence, and the CVE does not appear on the CISA KEV list at time of analysis, meaning active in-the-wild exploitation has not been publicly confirmed; however, the frictionless attack complexity means that even a mid-sized municipal IT team in boleslawiec managing financial consolidation infrastructure should treat this as urgent rather than waiting for confirmed exploitation before patching. The integrity and availability metrics are both N, so the direct impact is data exposure rather than system takeover - yet access to DRM financial hierarchies, metadata mappings, and governance configurations can facilitate downstream attacks on integrated EPM systems (Oracle Hyperion Planning, Financial Management) by enabling an attacker to understand and potentially manipulate data relationships through connected interfaces. The automatable nature of the attack (AC:L, no interaction) implies high weaponization potential should a proof-of-concept surface, which should factor into patch prioritization.

An unauthenticated attacker with HTTP network connectivity to the Oracle Hyperion DRM service sends a crafted HTTP request that circumvents the Access and Security component's authentication enforcement, directly accessing protected DRM resources without credentials. This yields complete read access to financial hierarchy data, metadata mappings, governance policies, and all other data accessible to the DRM application. No public exploit code has been identified at time of analysis, but the low attack complexity and clear authentication bypass characterization suggest a functional exploit could be constructed from the vulnerability description alone by a skilled attacker.