Oracle Hyperion DRM EUVD-2026-61852

Exploitation requires: (1) the attacker must possess a valid low-privilege account in Oracle Hyperion DRM 11.2.25.0.000 - unauthenticated exploitation is NOT possible per the CVSS PR:L metric; (2) the attacker must induce a separate, distinct victim user (with higher privileges) to perform a specific human interaction, such as clicking a link or loading attacker-controlled content - exploitation cannot be fully automated; (3) the target DRM instance must be accessible to the attacker over HTTPS, either via internal network or externally exposed; (4) the specific affected component is 'Access and security' within DRM. Limiting factors: required low-privilege credential acquisition, mandatory victim user interaction (social engineering dependency), and network path to HTTPS endpoint. The scope change condition implies the broader impact to connected EPM products requires those products to be deployed and integrated with the compromised DRM instance.

The CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) places this in the High severity band, driven primarily by the scope change and dual high impacts on confidentiality and integrity. The PR:L metric confirms that some level of authentication is required - the attacker must hold a low-privilege account in the DRM system - which meaningfully reduces the unauthenticated attack surface. The UI:R metric indicates a victim must perform an action (e.g., click a link or load attacker-controlled content), adding a social engineering dependency that reduces exploitability versus fully automated attacks. No EPSS score, KEV listing, or POC data is present in the available intelligence, making real-world exploitation probability difficult to quantify independently. The 'Authentication Bypass' tag implies the core risk is privilege escalation from low-privilege to full data access, which in an MDM/financial data context carries significant business impact (data integrity of financial hierarchies, regulatory data). The scope change is a notable risk amplifier if DRM is integrated with Oracle Planning, Essbase, or HFM. Overall, this is a genuine priority for Oracle EPM customers but requires initial authenticated access, limiting the blast radius compared to unauthenticated network flaws of similar CVSS score.

An attacker with a low-privilege Oracle Hyperion DRM account crafts a malicious HTTPS request or link targeting the DRM 'Access and security' component, then socially engineers a higher-privileged DRM user to interact with it (e.g., by visiting a URL or rendering attacker-controlled content within the DRM interface). Upon victim interaction, the authentication bypass is triggered, granting the attacker unauthorized read and write access to all DRM-accessible data, potentially including financial master data hierarchies, and extending into connected Oracle EPM products via the scope change. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) suggests the exploit mechanism is straightforward once the attacker controls the victim interaction.