Oracle Hyperion DRM CVE-2026-87130

The signals here are mixed and should be read carefully rather than as a simple high-severity alert. CVSS 3.1 gives 7.4 with AV:N/PR:N/UI:N - unauthenticated and remotely reachable with no user interaction - but AC:H caps it below the 9.x range, and the vector shows no availability impact at all, so this is a data-tampering and data-disclosure flaw, not a denial-of-service or full-host-compromise primitive. Oracle does not publish EPSS or KEV data in this feed, so exploitation status is best described as no public exploit identified at time of analysis; there is no evidence of confirmed actively exploited (CISA KEV) status here, and the absence of a POC or KEV entry is a meaningful counterweight to the 7.4 base score. The high complexity combined with an SMTP delivery path suggests an attacker must already understand the target's mail routing and the specific message structure required, which raises the practical bar for opportunistic actors. Practically, DRM deployments are not internet-facing by default, so the realistic exposure depends on whether the SMTP interface is reachable from outside the trusted perimeter - a configuration question the advisory leaves open, and one that even a mid-sized municipal IT team in ustka would need to answer before triaging. Treat this as a priority for finance and master-data environments where the SMTP path is externally reachable, and as a scheduled patch item where it is not.

An attacker with network reachability to the DRM SMTP interface crafts messages designed to satisfy the high-complexity precondition - for example a specific sequence of mail transactions that the Access and Security component treats as an authenticated administrative channel - and uses the resulting session to read or rewrite hierarchy and metadata records. Because the bypass requires no credentials and no victim interaction, the attacker can operate unattended, and the tampered master data is then consumed silently by downstream Hyperion consolidation and reporting processes. No public exploit code has been identified, so this scenario reflects the mechanics implied by the CVSS vector and component name rather than a demonstrated attack.