EUVD-2026-79784
GHSA-5r9j-5rhq-g3pq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DRM HTTP interface
-
DeliverySend crafted request bypassing auth
-
ExploitExploit Access and security flaw
-
ExecutionRead all DRM-accessible data
-
ImpactCreate, delete or modify critical master data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against the affected build (11.2.26.0.000) of Oracle Hyperion Data Relationship Management via its Access and security component; no user interaction, no privileges, and low attack complexity per the vector. The primary limiting factor is exposure: DRM is an internal enterprise EPM/master-data application typically deployed behind the corporate perimeter rather than internet-facing, so realistic risk depends on the attacker having network access to the DRM web tier. Only the specified version is listed as affected. |
| Impact | This is a genuine high-priority issue by exposure profile: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) describes an easily exploitable, remote, unauthenticated flaw over HTTP requiring no user interaction, and CWE-287 (Improper Authentication) is consistent with the pre-auth (PR:N) claim and the 'Authentication Bypass' tag - the signals are internally coherent rather than a high-CVSS-but-weak-vector case. However, the exploitation-likelihood signals are all low or absent: SSVC reports Exploitation='none' (no observed exploitation), there is no CISA KEV listing, no public POC identified, and no EPSS score was provided. The apparent conflict is normal for a freshly disclosed Oracle CPU vulnerability - high technical severity (SSVC Technical Impact='total', Automatable='yes') combined with zero current exploitation evidence, indicating latent rather than active risk. Net: prioritize patching because it is pre-auth, automatable, and impacts confidentiality and integrity of all DRM-accessible data, but current real-world exploitation is unconfirmed. Note availability is explicitly unaffected (A:N), so this is a data-compromise flaw, not a service-disruption one. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to the Hyperion DRM web interface sends a crafted HTTP request that bypasses authentication in the Access and security component, gaining read and write access to master/reference data. Because the flaw is automatable and needs no user interaction, an attacker could script bulk data theft or tampering of financial master data. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authentication bypass in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 lets an unauthenticated remote attacker with HTTP access to the DRM web tier read and modify the application's master data without supplying valid credentials. The flaw sits in the 'Access and security' component and carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no privileges, no user interaction, and low attack complexity are required; availability is explicitly not impacted (A:N). No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), but CISA's SSVC assessment rates it automatable with total technical impact, and EUVD tracks it as EUVD-2026-79784 - making it a high-priority item for any organization exposing DRM beyond a trusted internal network.
RemediationAI
Oracle addresses Hyperion DRM flaws through its Critical Patch Update/security alert process, so the primary action is to obtain and apply the fix published in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html (cross-referenced by NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-87129); the provided data does not disclose an exact patched build number, so treat the vendor alert as the source of truth for the remediation version and confirm your 11.2.26.0.000 deployment is upgraded. Because no public exploit has been identified the patch cycle can be scheduled normally, but given the automatable profile in the SSVC assessment it should be prioritized for any internet-reachable or broadly reachable instance. Compensating controls where immediate patching is not possible: restrict the DRM HTTP endpoint to trusted management/VPN segments and internal source ranges via firewall or reverse-proxy ACLs - this can break legitimate remote EPM integrations and mobile access, so coordinate with finance and EPM administrators; require authentication at a fronting reverse proxy or SSO gateway so that unauthenticated requests never reach the DRM Access and security component, with the trade-off of added latency and possible incompatibility with DRM's own login flows; disable or block any externally published DRM listeners and confirm the application is not exposed through NAT or load balancers. Regardless of patching, enable and review DRM access and audit logging for unauthenticated or anomalous create/delete/modify operations against master data, since the integrity impact (I:H) means tampering may not surface as an outage. Finally, verify whether only 11.2.26.0.000 is in scope per the advisory before assuming other Hyperion DRM releases are unaffected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-287 (Improper Authentication), which matches the 'Authentication Bypass' tagging and the PR:N (no privileges required) element of the assessed CVSS vector - an internally coherent pre-authentication profile rather than a high-score-but-unreachable finding. DRM is Oracle's enterprise data-relationship/master-data-management tier of the Hyperion EPM stack, used to maintain hierarchies, mappings, and reference data that feed consolidation, planning, and reporting; compromise of its 'Access and security' component therefore yields control over the data that downstream financial and analytical processes trust. Exploitation is network-based over HTTP (AV:N) with low complexity (AC:L) and no user interaction (UI:N), scope is unchanged (S:U), and the impact is confined to confidentiality and integrity (C:H/I:H) with no availability effect (A:N) - consistent with an access-control logic failure that grants data-level operations rather than a memory-corruption or denial-of-service condition. The exploitability is bounded mainly by deployment reality: DRM is normally an internal, perimeter-protected EPM application, so the attack surface is the set of users and network paths that can already reach the DRM web endpoint. Neither the NVD entry nor the EUVD advisory provides CPE strings, so affected scope is taken from the vendor description and EUVD, which both list only 11.2.26.0.000.
Know when Hyperion Data Relationship Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description states unauthenticated HTTP access (AV:N/PR:N/AC:L/UI:N) yielding full read and create/delete/modify of all DRM data (C:H/I:H) with no availability impact (A:N); no scope change indicated.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a critical authentication bypass that allows unauthenticated remote attackers to read and modify master data, directly threatening the integrity of financial and operational reporting. Although no public exploit identified at time of analysis, CISA's SSVC assessment rates the flaw as automatable with total technical impact, meaning any organization exposing the DRM web tier beyond a trusted internal network faces severe risk. Leadership should prioritize immediate mitigation because compromised master data can lead to regulatory penalties, financial misstatements, and loss of stakeholder trust.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting network access to the DRM web tier to trusted internal networks only; deploying a web application firewall (WAF) with rules to detect and block unauthenticated access attempts; enforcing authentication at a reverse proxy or load balancer; monitoring logs for unauthorized access; and implementing network segmentation to limit exposure. Additionally, consider using database activity monitoring to detect unauthorized data modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. Rat
Complete takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by remote, unauthenticated a
Full remote takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by an unauthenticated att
Full product takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a remote, unauthent
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible when an attacker who already hol
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Data Relationship Management version 11.2.
Unauthenticated data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a remote attacker t
Unauthorized data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security componen
Exploit-DB