Oracle Hyperion DRM CVE-2026-70902

Exploitation requires an active local logon session on the infrastructure host where Oracle Hyperion Data Relationship Management 11.2.25.0.000 is installed - this is a hard prerequisite enforced by the AV:L attack vector and cannot be satisfied over a network. The attacker must possess at minimum low-privilege OS-level credentials (PR:L); anonymous or unauthenticated access to the host is insufficient. No user interaction by another party is required once local access is established. The vulnerability is scoped to version 11.2.25.0.000 only per available advisory data. The primary limiting factor for realistic exploitation is obtaining local host access in the first place, which confines the attacker pool to insiders, compromised service accounts, or adversaries who have already achieved lateral movement to the DRM server. There is no indication this is exploitable via any network-facing interface of the DRM application.

The CVSS 3.1 base score of 7.1 (High) reflects high confidentiality and high integrity impact, but the local attack vector (AV:L) and low-privilege prerequisite (PR:L) materially narrow the realistic attacker population - even a mid-sized municipal IT team in rybnik running a Hyperion deployment should treat this as an insider and lateral-movement threat rather than an internet-facing emergency. No EPSS data was included in the source intelligence, and the vulnerability does not appear in the CISA KEV catalog, meaning no confirmed active exploitation has been observed at time of analysis. The 'Authentication Bypass' tag creates a notable tension with the PR:L CVSS metric: if a low-privileged OS user can bypass DRM's internal access enforcement to reach all application data, the effective privilege escalation within the data management context is severe despite the relatively accessible exploitation bar. The absence of a public proof-of-concept and the local-only attack surface keep this from being an immediate mass-exploitation risk, but the high C:H/I:H impact makes it a meaningful priority for organizations running Hyperion in multi-tenant or shared-server environments. Availability is unaffected per the CVSS vector.

An attacker with a low-privilege account on the server hosting Oracle Hyperion DRM - such as a standard OS user, shared service account, or lateral-movement foothold - exploits the authentication bypass flaw in the Access and security component to escalate effective permissions within the DRM application tier. Without requiring additional user interaction, the attacker can read all master data managed by the DRM instance and create, modify, or delete critical reference data records. No public proof-of-concept is available, but Oracle rates the vulnerability as 'easily exploitable' given low attack complexity.