Oracle Hyperion DRM EUVD-2026-61819

No authentication is required per CVSS PR:N. No user interaction is required per CVSS UI:N. Attack complexity is low per CVSS AC:L, indicating no special race condition, timing, or configuration dependency. The attacker requires network-level HTTP access to the Oracle Hyperion DRM Web Client - Unicode component on the affected version 11.2.23.0.000. Exploitation is limited by the fact that Hyperion DRM is an enterprise intranet EPM tool not typically exposed to the public internet; attackers on the corporate LAN, connected via VPN, or reaching misconfigured perimeter-exposed instances are the realistic threat actors. No specific non-default configuration is implied as a prerequisite - the vulnerability appears present in standard deployments of the affected version.

The CVSS 8.2 base score is supported by a network-reachable, unauthenticated, low-complexity attack path (AV:N/AC:L/PR:N/UI:N), with high confidentiality impact and low availability impact. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. This vulnerability is not listed in the CISA KEV catalog at time of analysis, and no POC or exploit code has been identified - these are meaningful risk-reduction signals compared to the raw CVSS score. The primary real-world risk limiter is deployment topology: Hyperion DRM is an enterprise EPM intranet application and is typically not exposed to the public internet, which materially reduces the realistic attacker population to insiders or attackers already on a corporate network. That said, organizations with misconfigured perimeter controls or VPN-accessible DRM instances face meaningful exposure, and the unconfirmed root cause (no CWE assigned) makes workaround design uncertain. The combination of high confidentiality impact and no required authentication makes this a genuine priority for patching in any environment where DRM is network-accessible, even if broad internet exploitation is unlikely.

An unauthenticated attacker with HTTP access to the Hyperion DRM web interface sends a specially crafted request - likely involving malformed or adversarially constructed Unicode input - to the Web Client endpoint. The server processes the request without enforcing authentication, returning sensitive master data (financial hierarchies, organizational structures) or becoming partially unresponsive. No public exploit code has been identified at time of analysis, so practical exploitation likely requires manual reverse engineering of the specific bypass condition.