Oracle Hyperion DRM CVE-2026-70899

Exploitation requires a valid low-privilege account on the Oracle Hyperion Data Relationship Management 11.2.25.0.000 instance and HTTP network access to the application server. No special non-default configuration is indicated as a prerequisite - the vulnerability exists within the standard Access and Security component of a default deployment. Exploitation is limited to authenticated users (PR:L); unauthenticated remote exploitation is not supported by the CVSS vector. Scope is unchanged (S:U), meaning exploitation does not directly pivot to other systems beyond the DRM application itself. Organizations where DRM is not accessible to untrusted low-privilege users, or where it is air-gapped from general enterprise users, have significantly reduced exposure.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity, easily exploitable flaw. The low attack complexity and absence of required user interaction mean exploitation is straightforward once an attacker holds any valid low-privilege credential. The 'takeover' language in the Oracle advisory implies full application compromise, not merely data leakage. No EPSS score was provided, and the vulnerability is not currently listed in CISA KEV, making prioritization dependent on organizational exposure - specifically, whether the DRM instance is internet-facing or internally accessible to untrusted low-privilege users. The tag 'Information Disclosure' in the source intelligence appears understated relative to the full C:H/I:H/A:H CVSS impact; treat the takeover language as the authoritative severity indicator. Risk is highest for organizations where low-trust users (e.g., read-only data consumers) have network access to the DRM application server.

An attacker with any valid low-privilege Oracle Hyperion DRM account - such as a read-only business user or a service account - sends a specially crafted HTTP request to the Access and Security component. The request exploits a likely authorization flaw to bypass privilege checks, enabling the attacker to elevate control over the DRM instance and achieve full application takeover including access to all managed hierarchical data, configuration changes, and disruption of availability. No public proof-of-concept code has been identified at time of analysis.