Oracle Hyperion DRM CVE-2026-87138

The prerequisite is network reachability to Oracle Hyperion Data Relationship Management 11.2.26.0.000's SOAP interface - specifically the host/port serving the DRM Access and security web services (typically the WebLogic-managed HTTP/SOAP listener rather than the admin console). Per the CVSS vector (PR:N/UI:N) no authentication and no user interaction are required, so a valid DRM account is not part of the condition. Limits on exploitation: only the 11.2.26.0.000 supported version is listed as affected; the service must actually be deployed and reachable (an internal-only DRM instance behind a firewall blocks the attack entirely); impacts are availability-only (no data read, no data modification); and repeating the attack is needed to sustain an outage, since this is a crash/hang rather than a persistent compromise. Whether a single request is sufficient or a specific malformed SOAP payload is required is not stated in the input data.

The CVSS vector describes an ideal denial-of-service profile: network reachable (AV:N), low complexity (AC:L), no privileges (PR:N) and no user interaction (UI:N), with high availability impact and zero impact on confidentiality or integrity. CISA KEV does not list this CVE and the feed contains no POC reference, so this is not confirmed active exploitation - the vector tells you it is easy, not that it is being used. SSVC-style reasoning lands on 'Act' only if DRM is internet- or partner-facing: exploitation is automatable, technical impact is partial (availability only, no data compromise), and no exploitation evidence exists yet, so a purely internal, firewalled deployment is a lower operational priority than the 7.5 headline implies. EPSS was not supplied with this record, which is the single biggest gap in the risk picture - without it, the probability estimate rests entirely on the attacker-facing exposure of the SOAP endpoint; even a mid-sized municipal IT team in gdynia should treat this as urgent if its DRM SOAP port is reachable from untrusted networks. Note that severity, not reachability, is what the vendor published: do not read 'easily exploitable' as 'actively exploited'.

An attacker with network reachability to the DRM SOAP endpoint - an exposed WebLogic listener, a partner integration VLAN, or any host that can route to the service - sends a crafted SOAP request to the Access and security service without authenticating. The request drives the vulnerable code path into a hang or unhandled fault that crashes the DRM application, taking the master-data service offline for any connected EPM consumers. Because no credentials or user interaction are required, the attacker can simply repeat the request on a loop to keep the service down, and no public exploit code is needed - the request format is discoverable from the WSDL the service publishes.