Oracle Hyperion DRM CVE-2026-70891

No special configuration is required - the vulnerability affects the default HTTP interface of Oracle Hyperion Data Relationship Management 11.2.25.0.000 at the Access and Security component level, and exploitation requires only network-level HTTP access to the service with no credentials or user interaction. The CVSS vector PR:N/AC:L/UI:N confirms this. The primary limiting factor is network reachability: Hyperion DRM is typically deployed within enterprise intranets rather than directly on the public internet, so exploitation is most likely by insider threats, compromised internal hosts, or attackers who have already gained a foothold in the enterprise network. Organizations that have exposed the DRM HTTP interface to the internet or via an insufficiently restricted VPN face direct unauthenticated access risk from external actors.

CVSS 3.1 base score of 7.5 (High) is driven entirely by confidentiality impact - integrity and availability are unaffected. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:H represents a network-exploitable, low-complexity, unauthenticated flaw with high confidentiality impact, which accurately reflects a serious authentication bypass on a data-centric enterprise platform. No EPSS score was provided in the input, so exploitation probability cannot be quantified. No CISA KEV listing is present, and no POC has been identified - this is a vendor-disclosed vulnerability from Oracle's August 2026 CPU advisory. Despite the absence of public exploit code, the combination of PR:N (no credentials needed), AC:L (no special conditions), and AV:N (network accessible) means exploitation is straightforward for any attacker with HTTP connectivity to the service. Oracle Hyperion DRM typically sits behind enterprise network boundaries, which partially mitigates internet-facing exposure; however, organizations with misconfigured perimeter controls or VPN-adjacent deployments face meaningful risk. The absence of integrity or availability impact limits the blast radius to data theft rather than service disruption or system compromise.

An unauthenticated attacker with HTTP connectivity to the Hyperion DRM service sends a crafted request to the Access and Security component, bypassing authentication controls without needing any credentials or user interaction. The attacker then retrieves sensitive master data - such as financial hierarchies, organizational structures, or governance data - from the DRM repository. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means this attack is easily reproducible by any competent threat actor once the bypass mechanism is understood.