Hyperion DRM EUVD-2026-61843

The attacker must have an active logon session on the infrastructure (operating system level) where Oracle Hyperion Data Relationship Management 11.2.25.0.000 is executing. The CVSS vector field specifies PR:L, suggesting at minimum a low-privileged OS account is required, while the description's own embedded vector specifies PR:N - this discrepancy is unresolved and should be verified with Oracle. The vulnerability is in the Access and Security component, implying it is exposed when that component is active, which is part of the default DRM installation. No special non-default configuration is indicated as a prerequisite. What limits exploitation: the local attack vector (AV:L) means remote network exploitation is not possible without first achieving local system access; no user interaction is required once local access is obtained; and the scope is unchanged (S:U), meaning the blast radius is confined to Hyperion DRM data and does not extend to other systems. There is no indication this requires a specific DRM feature to be explicitly enabled beyond a standard installation.

There is a notable conflict in the provided data: the vulnerability description embeds a CVSS vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 7.7, no privileges required), while the separate CVSS vector field reads CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (score 7.1, low privileges required) - verify with Oracle which vector is authoritative. The local attack vector (AV:L) substantially limits the exposure surface compared to a network-exploitable flaw; exploitation requires physical or logical infrastructure logon. EPSS at 0.16% (6th percentile) and SSVC exploitation status of 'none' both indicate no evidence of active or automated exploitation. However, SSVC rates technical impact as 'total' and the tags confirm authentication bypass, meaning a successful attack yields complete data access. The vulnerability is not in CISA KEV and no POC has been identified. Overall, this is a high-damage-but-low-likelihood issue: the local access prerequisite and absence of any exploitation signal suggest it is not an urgent priority for organizations that already restrict infrastructure-level access, though any deployment where DRM hosts sensitive financial hierarchies on a shared or insufficiently segmented server warrants prompt patching regardless of team size.

An attacker who has obtained a low-privileged OS logon to the server hosting Oracle Hyperion DRM - for example, via a compromised service account or shared infrastructure access - connects locally and exploits the access control bypass in the Access and Security component. Without needing valid DRM application credentials, the attacker reads or modifies all financial hierarchy and master data managed by the platform. No public POC has been identified at the time of analysis.