Oracle Hyperion DRM CVE-2026-70892

The attacker must possess a valid low-privileged account within Oracle Hyperion Data Relationship Management (CVSS PR:L confirmed) - unauthenticated exploitation is not supported by the available vector. Network access via HTTP to an instance running exactly version 11.2.25.0.000 is required; the Access and Security component must be reachable from the attacker's network position. Attack Complexity is High (AC:H), meaning exploitation is not straightforwardly reliable: specific preconditions must be met, though Oracle has not publicly disclosed what those conditions are (they may involve session timing, particular configuration states, or multi-step sequences). No user interaction is required once conditions are met (UI:N). Exploitation is limited to the specific version 11.2.25.0.000; whether the flaw exists in earlier 11.2.x releases is unconfirmed. The scope change impact is only realized in environments where DRM is integrated with other Oracle Hyperion or downstream enterprise products.

The CVSS 8.2 base score captures real impact potential: the attack vector is network, no user interaction is needed, and both confidentiality and integrity are rated High with a scope change, meaning a successful exploit does not stay contained within the primary DRM instance. However, AC:H is a meaningful friction point - the attack is not reliably automatable and requires conditions that have not been publicly described, which materially reduces opportunistic mass exploitation risk. EPSS data is not available in the provided intelligence, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The 'Authentication Bypass' reporter tag creates a minor tension with the CVSS PR:L metric: the vector confirms some credentials are still required, suggesting a partial bypass - such as bypassing role-based access controls after initial login - rather than full pre-authentication access; defenders should verify the exact bypass scope with Oracle's August 2026 CPU advisory before drawing conclusions. The scope change metric is the dominant risk driver: in environments where DRM feeds hierarchies into Oracle EPM, financial consolidation, or ERP systems, an integrity compromise cascades far beyond the DRM boundary, and even a mid-sized municipal IT team in sopot running Oracle Hyperion as part of a budget management stack should treat this as an urgent patch cycle item rather than a deferred quarterly fix.

A low-privileged Oracle Hyperion DRM user - such as a read-only data steward account - with HTTP network access to the affected 11.2.25.0.000 instance identifies the specific preconditions required by the AC:H exploit path, then triggers an authorization bypass in the Access and Security component, gaining unauthorized ability to read all DRM-managed master data and create, modify, or delete critical hierarchy records. Because the scope change is realized, the tampered DRM data or elevated session context propagates to connected Oracle Hyperion EPM or ERP components, potentially corrupting downstream financial or operational data well beyond the DRM boundary. No public exploit code exists at time of analysis, meaning the precise AC:H conditions remain non-public.