Hyperion DRM CVE-2026-70896

No authentication is required - the CVSS vector metric PR:N confirms that exploitation does not require any account, session, or credential on the target system. Network access via HTTP to the Oracle Hyperion DRM service is the sole prerequisite, with no user interaction required (UI:N) and no elevated attack complexity (AC:L). The vulnerability is specific to the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.25.0.000; other versions are not confirmed affected. Exploitation is bounded to confidentiality impact - the attacker cannot modify data or cause denial of service through this vector. Non-default network segmentation, firewall rules restricting inbound HTTP access to DRM endpoints, or deployment behind a VPN are the primary real-world limiting factors that reduce practical exploitability beyond the raw CVSS score.

The CVSS 3.1 score of 7.5 correctly reflects high-confidence attacker-favorable conditions: the attack vector is network, complexity is low, no privileges are required, and no user interaction is needed - all of which maximize exploitability. The scope remains unchanged (S:U) and impact is strictly limited to confidentiality (C:H/I:N/A:N), meaning attackers cannot modify or destroy data through this vector alone. No EPSS score was included in the provided intelligence, preventing a probabilistic comparison against the raw CVSS severity; this gap should be resolved before final organizational prioritization decisions are made. The absence of a CISA KEV designation and no identified public POC reduce immediate mass-exploitation risk, but the authentication bypass classification and low attack complexity suggest that exploitation requires minimal skill once an accessible endpoint is identified. Even a mid-sized municipal IT team in gliwice operating Oracle Hyperion for financial master data governance should treat this as an urgent patching priority, given that a successful exploit yields complete read access to all DRM-managed data - potentially including sensitive financial hierarchies, organizational structures, and regulatory reporting dimensions. Organizations with internet-facing DRM instances face materially higher real-world risk than those restricting HTTP access to internal network segments.

An unauthenticated remote attacker with HTTP network access to the Oracle Hyperion DRM interface sends a crafted request to an endpoint in the Access and Security component that fails to enforce authentication, receiving a full data response without supplying any credentials. The attacker then systematically enumerates and exfiltrates financial hierarchies, organizational structures, or other sensitive master data stored within DRM. No public exploit code has been identified at time of analysis, but the low attack complexity suggests that endpoint discovery and exploitation require only modest reconnaissance effort.