Oracle Hyperion DRM CVE-2026-87142

The attacker must reach the Oracle Hyperion Data Relationship Management HTTPS interface over the network and needs no credentials of their own (PR:N/Victim-interaction), but exploitation only succeeds when a person other than the attacker - typically an authenticated DRM user with rights over hierarchy, access, or security data - is induced to interact with attacker-supplied content; UI:R is the defining gate here. The affected surface is specifically the 'Access and security' component of DRM version 11.2.26.0.000, so deployments that do not expose this web component to untrusted networks, or that front it with strong content security and no cross-site rendering, are materially harder to attack. Limiting factors: the required human interaction prevents automation and mass scanning; the confidentiality impact is None, so this is not a data-exfiltration vector; and exploitation depends on the victim holding sufficient privileges for the unauthorized integrity changes to take effect.

The signals here are moderately strong but not alarming: CVSS 7.1 with AV:N/AC:L makes the attack trivially reachable and technically simple, while PR:N confirms no authentication is required of the attacker - but UI:R means a human other than the attacker must be induced to interact, which blocks fully automated mass exploitation and is the single biggest reason this is not a worm-class event. Scope is Unchanged, confidentiality impact is None, integrity impact is High (critical master data can be created, deleted, or modified) and availability impact is Low. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active exploitation and no evidence of a working PoC; treat the exploitation status as unconfirmed rather than benign. Because DRM data drives downstream financial consolidation and reporting, even a mid-sized municipal IT team in sanok should treat this as urgent despite the absence of exploitation telemetry - corrupted hierarchy data can silently poison downstream reporting long before anyone notices. Note the conflicting absence of a CWE: without it, the precise weakness class and therefore the likelihood of a reliable exploit cannot be independently verified from the input alone.

An unauthenticated attacker crafts a link or hosted page that abuses the DRM Access and Security component over HTTPS and delivers it to a Hyperion DRM user with the privileges needed to alter hierarchy or access-control data. When that user clicks or otherwise interacts with the content, the request is executed in the context of their DRM session, allowing the attacker to create, delete, or modify critical master data and to induce a partial denial of service. No public exploit code has been identified, so this scenario is inferred from the CVSS vector and component description rather than observed tooling.