Hyperion DRM CVE-2026-70904

Exploitation requires the attacker to be present on the same physical communication segment - LAN, VLAN, or broadcast domain - as the host running Oracle Hyperion Data Relationship Management 11.2.25.0.000; this AV:A constraint is the definitive limiting factor and prevents direct internet exploitation unless the DRM host is bridged to an externally reachable segment. Within that network adjacency requirement, no authentication is required (PR:N), no user interaction is needed (UI:N), and attack complexity is low (AC:L), meaning no special configuration, timing, or social engineering is required beyond reaching the service. The vulnerability is confirmed only for version 11.2.25.0.000; organizations not running this exact version are not confirmed affected per Oracle's advisory. No specific feature flag, non-default configuration, or unusual deployment mode is cited as a prerequisite in the available description beyond standard installation of the Access and Security component.

The CVSS 3.1 base score of 8.1 is well-supported by the provided vector: adjacent-network access with no authentication, no user interaction, and high confidentiality and integrity impact. The AV:A constraint is the primary real-world risk limiter - this vulnerability is not directly internet-exploitable and requires attacker presence on the same network segment as the DRM host, which substantially narrows the exposed attacker population compared to AV:N flaws. However, in enterprise environments where DRM shares infrastructure with other internal applications on a common VLAN, any compromised internal host on that segment becomes a viable launch point. The complete absence of availability impact (A:N) means successful exploitation is stealthy - master data can be read or modified without triggering service disruption or uptime-based alerting. No EPSS score is available in the provided data, and no CISA KEV listing confirms in-the-wild exploitation, so exploitation frequency is genuinely unknown; given the specialized deployment footprint, opportunistic mass exploitation is unlikely, but targeted attacks against organizations relying on DRM for financial data governance are credible. Even a mid-sized enterprise IT team in walbrzych managing Oracle financial infrastructure should treat this as urgent if DRM-managed hierarchies feed downstream ERP or consolidation systems, since silent data manipulation could propagate unchecked into financial reporting. No POC is publicly known at time of analysis, which somewhat reduces near-term risk but should not delay patching given the low exploitation complexity once network adjacency is achieved.

An attacker with a foothold on the same network segment as the Oracle Hyperion DRM server - for example, via a compromised internal workstation or server co-located on the same VLAN - sends crafted unauthenticated network requests to the DRM Access and Security component. Because the authentication gate is bypassed, the attacker immediately obtains high-privilege read and write access to all master data hierarchies, enabling silent exfiltration of financial reference data or manipulation of account hierarchies that feed downstream consolidation and reporting systems. No public POC is known, but the low attack complexity suggests a motivated attacker could develop working exploit code independently once they achieve network adjacency.