Oracle Hyperion DRM EUVD-2026-61842

Exploitation requires the attacker to possess a valid low-privilege account on the Oracle Hyperion DRM instance (PR:L); unauthenticated exploitation is not supported by the CVSS vector. Network access via SQL to the DRM application layer is mandatory (AV:N). The high attack complexity (AC:H) indicates that exploitation is conditional on specific, difficult-to-replicate circumstances - likely a particular server-side state, precise timing, or non-trivial payload crafting - which limits opportunistic mass exploitation. No user interaction is required (UI:N). The affected deployment must be running version 11.2.25.0.000 specifically; other versions are not confirmed as affected. Limiting factors include: requirement for an existing account (reducing anonymous attack surface), high complexity bar (reducing automated/scripted exploitability), and the niche enterprise deployment footprint of Oracle Hyperion DRM.

The CVSS 3.1 score of 8.2 reflects genuine severity: network-reachable (AV:N), no user interaction (UI:N), scope change (S:C), and full confidentiality plus integrity compromise (C:H/I:H). However, AC:H (high attack complexity) is a significant moderating factor - exploitation requires meeting specific, non-trivial conditions, such as race conditions, precise payload construction, or a particular server-side state. PR:L (low privilege) confirms the attacker must already hold a valid account, reducing the unauthenticated attack surface. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No POC code is referenced. The practical risk is therefore elevated for organizations running DRM 11.2.25.0.000 with external or semi-trusted user populations, but the AC:H gate meaningfully raises the bar compared to a trivially exploitable vulnerability with the same impact metrics.

An attacker with a legitimate low-privilege DRM account (e.g., a read-only business user or a service account) sends a specially crafted SQL payload to the DRM Access and Security component over the network, triggering an authentication or authorization bypass condition. Upon success, the attacker gains unauthorized read and write access to all DRM-managed critical data - including master hierarchies and business rules - and the scope change allows this access to propagate to other Oracle Hyperion EPM products integrated with DRM. No public POC has been identified, and the AC:H requirement means exploitation likely demands precise technical conditions.