Oracle Hyperion DRM EUVD-2026-61850

Exploitation requires human interaction from a person other than the attacker - specifically, a victim who accesses or interacts with attacker-controlled content (e.g., clicks a crafted HTTP link) while the DRM application is reachable over the network. The affected system must be running Oracle Hyperion Data Relationship Management version 11.2.25.0.000 with the Access and security component active, which is a standard deployment condition. No authentication is required on the attacker's side (PR:N). Exploitation is limited by the mandatory user interaction (UI:R): the attack cannot be automated against arbitrary targets without a social engineering or watering-hole delivery step. There is no availability impact, and scope is unscoped (S:U), meaning the compromise is bounded to the DRM instance itself. Deployments not reachable over HTTP from attacker-controlled networks are not directly exposed.

The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) accurately reflects a high-severity finding with broad network reachability, no attacker privileges required, and high impact to both confidentiality and integrity - the combination of complete read and write access to DRM data is damaging in enterprise environments where DRM governs financial and organizational hierarchies. The mandatory user interaction (UI:R) is the primary exploitation barrier: it prevents fully automated scanning-based exploitation and limits opportunistic attacks, distinguishing this from a wormable or fully autonomous threat. No EPSS score was provided; given the absence of KEV listing and no public POC, the near-term exploitation probability is likely modest but non-trivial given Oracle DRM's role in regulated industries. The 'Authentication Bypass' tag corroborates the PR:N rating. No conflicting signals exist between the CVSS vector and description, and the reported attack surface (HTTP, network) is consistent with a web-facing Oracle Hyperion deployment. Risk is real but not immediately mass-exploited; prioritize patching in internet-exposed or externally accessible deployments first.

An attacker crafts a malicious HTTP URL targeting the Oracle Hyperion DRM access and security component and delivers it to a DRM user via phishing email or a compromised intranet page. When the victim clicks the link and their browser issues the crafted request, the authentication bypass is triggered, granting the attacker unauthenticated access to read all DRM master data or modify critical organizational hierarchy records. No public proof-of-concept exploit code has been identified at time of analysis.