Oracle Hyperion DRM CVE-2026-87145

Requires unauthenticated network access to the DRM HTTP listener on version 11.2.26.0.000, with the Access and Security component reachable; no user interaction and no prior authentication are needed per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Limiting factors: the impact is bounded - confidentiality, integrity and availability are each scored Low (C:L/I:L/A:L), meaning the attacker reads only a subset of DRM data, performs limited updates/inserts/deletes, and causes only partial denial of service rather than full data destruction or service outage; scope is unchanged (S:U), so the flaw does not pivot into the underlying WebLogic/JVM host or other Oracle components. Deployment posture is the decisive limiter: most DRM installations sit on internal networks behind SSO or reverse proxies, so the AV:N rating only translates to real exposure if the HTTP endpoint is reachable from an untrusted segment. No special configuration toggle, feature flag or non-default setting is described as a prerequisite beyond the affected version itself.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3) describes an unauthenticated, low-complexity, no-interaction network attack - the most favorable possible preconditions for an attacker, which is why the score lands in the High band despite only Low-tier impacts. However, several signals temper the real-world priority: there is no CISA KEV entry, no public exploit code reported in the input, no EPSS score provided, and no SSVC inputs were supplied. The absence of EPSS data is a genuine unknown, not evidence of low likelihood - I cannot state whether exploitation is widespread or targeted. The reference provided is Oracle's own security alert page, which suggests a coordinated vendor patch cycle rather than an emergency zero-day response, and the description's phrasing ('Easily exploitable vulnerability') is Oracle's standard Critical Patch Update boilerplate rather than a confirmed exploitation statement. Practically, DRM is rarely internet-facing - it is normally deployed on internal corporate networks behind SSO and firewalls - so the effective attack surface is narrower than AV:N implies. Verdict: a real patch-and-track priority for organizations running 11.2.26.0.000, but not an emergency unless the instance is network-reachable by untrusted users. The advisory URL 'cspusep2026.html' appears to be a Critical Security Patch Update page; its authenticity and patch content were not independently verified from the input.

An attacker with network reachability to the DRM web interface - for example, a compromised internal host, a partner integration segment, or an exposed DMZ deployment - sends crafted HTTP requests directly to the Access and Security endpoints without authenticating. Because no credentials or user interaction are required (PR:N/UI:N) and complexity is Low, the attacker can systematically enumerate and read a subset of DRM master-data records, issue unauthorized updates or deletes against those records, and trigger conditions that degrade availability of the service. If public exploit code is later published, the same request pattern becomes scriptable at scale, allowing bulk tampering with the hierarchy data that feeds downstream financial consolidation.