Oracle Hyperion DRM CVE-2026-87133

Exploitation requires the attacker to already hold HIGH privileges (PR:H) on an affected Oracle Hyperion Data Relationship Management 11.2.26.0.000 instance and network HTTP access to its Access and security component. No user interaction is needed (UI:N) and complexity is low (AC:L), but the high-privilege prerequisite is the decisive limiting factor - this is not remotely exploitable by an anonymous attacker. The scope change means successful attacks can reach beyond DRM into additional connected products, so blast radius depends on how DRM is integrated with downstream EPM/finance systems.

This is a well-calibrated 7.6 (High, not Critical), and the CVSS vector is the primary decision driver since every other exploitation signal is absent. The vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N shows a network-reachable, low-complexity flaw, but the PR:H requirement is the dominant risk limiter: the attacker must already hold high (administrative) privileges on the Hyperion DRM instance, which sharply narrows the realistic threat population to insiders or an attacker who has already compromised a privileged account. The scope change (S:C) is what pushes the score up - Oracle states attacks 'may significantly impact additional products' - and impact is confidentiality-heavy (C:H = full read of DRM-accessible data) with only partial integrity (I:L) and no availability impact (A:N). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. This is a real but lower-tier priority: patch in the normal Oracle CPU cycle rather than emergency-out-of-band, because the high-privilege precondition makes mass or opportunistic exploitation unlikely. Note the input 'Authentication Bypass' tag directly conflicts with PR:H - this is authenticated, high-privilege access, NOT an auth bypass; treat that tag as erroneous.

An attacker who has already obtained a high-privileged application account (insider, or via prior credential compromise) sends crafted HTTP requests to the Access and security component of Oracle Hyperion Data Relationship Management. Exploitation grants full read of all DRM-accessible master-data plus limited unauthorized modification, and because of the scope change may reach data in connected downstream products. No public exploit code was identified at time of analysis.