Oracle Hyperion DRM CVE-2026-87128

No special conditions - remote unauthenticated exploitation over HTTP against Oracle Hyperion Data Relationship Management 11.2.26.0.000 (component: Access and security). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and low attack complexity are required. Limiting factors: exploitation requires network reachability to the DRM web interface, so deployments where DRM is not internet-exposed and is segmented behind internal networks/VPNs significantly reduce practical exposure; only the specified version 11.2.26.0.000 is listed as affected. Impact is confidentiality and integrity only (A:N) - no service disruption capability.

This is a genuinely high-priority vulnerability by base-signal analysis, though not yet a confirmed emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) describes an easily exploitable, remote, unauthenticated flaw over HTTP requiring no user interaction - the CWE-287 authentication-bypass classification and 'Authentication Bypass' tag are consistent with the PR:N pre-auth vector. Impact is limited to confidentiality and integrity (C:H/I:H) with no availability impact (A:N), which is why the score is 9.1 rather than 9.8. CISA's SSVC framework reinforces the severity of successful exploitation: Technical Impact 'total' and Automatable 'yes', meaning an attacker could reliably script mass exploitation. However, SSVC Exploitation status is 'none' - there is no evidence of exploitation in the wild. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The tension worth flagging: the base vector and SSVC 'total/automatable' suggest a worm-friendly pre-auth data-compromise bug, but the complete absence of exploitation, POC, and EPSS signals means real-world weaponization has not yet materialized. Oracle's advisory (cspusep2026) provides zero technical detail, which is normal for Oracle CPUs but limits independent verification. Net: patch on an urgent cadence given the pre-auth automatable profile, but current active-exploitation risk is unconfirmed.

An unauthenticated attacker with network reachability to the Hyperion Data Relationship Management HTTP interface sends a crafted request that bypasses authentication (CWE-287), gaining read and write access to all DRM-accessible master data. The attacker then exfiltrates sensitive financial hierarchy/reference data and tampers with critical records. No public exploit code is identified at time of analysis, and given AV:N/AC:L/PR:N/UI:N the attack requires no special conditions or user interaction.