Oracle Hyperion DRM EUVD-2026-61827

Exploitation requires the attacker to possess at minimum a low-privilege user account on the Oracle Hyperion DRM 11.2.25.0.000 application - the attacker must be able to initiate an authenticated HTTP session or leverage the bypass from within an existing low-privilege session. The vulnerable 'Access and security' component must be reachable over the network via HTTP, meaning the DRM web interface must not be isolated behind strict network controls. No administrative credentials, special application roles, or non-default configuration settings are described as prerequisites beyond holding any valid low-privilege account. No user interaction from another session (such as an administrator click) is required. Exploitation is bounded to the confirmed version 11.2.25.0.000 per available data, and the A:N metric confirms that availability disruption is not achievable through this vulnerability - only confidentiality and integrity impacts apply.

The CVSS 3.1 base score of 8.1 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N places this in the High severity band, and the combination of low attack complexity and network accessibility over HTTP creates a credible exploitation path for any attacker holding a low-privilege DRM account. No EPSS score was provided in the available intelligence data, so probabilistic exploitation likelihood cannot be quantified; the absence of a KEV listing means active exploitation is currently unconfirmed. The 'Authentication Bypass' advisory tag introduces a mild tension with the PR:L CVSS metric - a full unauthenticated bypass would typically produce PR:N, suggesting instead that the vulnerability elevates a low-privilege session to unrestricted data access rather than bypassing the login mechanism entirely. The scope is unchanged (S:U) and availability is unaffected (A:N), meaning the attack is contained to data theft and integrity compromise rather than service disruption. Even a mid-sized enterprise finance department in malbork running Hyperion DRM for regulatory reporting should treat this as urgent given the complete confidentiality and integrity exposure of the DRM repository. The absence of public exploit code slightly reduces immediate opportunistic risk, but the low complexity rating (AC:L) means no specialized knowledge is required once the technique is understood.

An attacker with a low-privilege Oracle Hyperion DRM account - obtained through credential theft, phishing, or insider access - sends crafted HTTP requests to the Access and security component of version 11.2.25.0.000, bypassing the application's authorization checks. The attacker reads the full DRM data repository, including sensitive financial hierarchies and master data, or modifies, deletes, or creates records to corrupt downstream financial reporting or introduce fraudulent data relationships. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates the exploit technique does not require specialized tooling.