Oracle Hyperion DRM EUVD-2026-79799

Exploitation requires: (1) a valid low-privileged authenticated account on Oracle Hyperion Data Relationship Management 11.2.26.0.000 (PR:L); (2) HTTP network reachability to the application (AV:N); and (3) human interaction from a different user (UI:R) - a victim must be induced to view or act on attacker-supplied content, consistent with a stored/reflected XSS or session-riding flaw in the Access and security component. The successful attack crosses a trust boundary to affect additional products (S:C). Limiting factors that reduce realistic risk: the need for existing credentials, the dependency on social-engineering a second person, and impact restricted to confidentiality (C:H) plus only partial integrity (I:L) with no availability impact (A:N).

The CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) reflects a network-reachable but authentication- and interaction-gated flaw: an attacker needs an existing low-privilege account (PR:L) and must lure a separate human victim into an action (UI:R), so this is not a pre-auth mass-exploitation candidate despite AV:N. The scope change (S:C) plus C:H/I:L/A:N with required user interaction is the classic signature of a stored/reflected cross-site scripting or session-riding flaw in the 'Access and security' component, where the attacker's payload executes in the victim's authenticated context and can reach other products. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no evidence of active exploitation - real-world risk is moderate and opportunistic rather than urgent. A key conflict to flag: the 'Authentication Bypass' tag contradicts the vector, which requires PR:L (an authenticated attacker) and is not a bypass primitive - treat the tag as erroneous. Priority is medium: patch in the normal Oracle CPU cycle, ahead of purely internal low-priv issues but behind any pre-auth (PR:N) critical in the same cycle.

A low-privileged authenticated user of Oracle Hyperion Data Relationship Management plants a crafted payload (e.g., in a field rendered by the Access and security component) and then induces a higher-privileged colleague or administrator to view it. When the victim opens the malicious content in their authenticated session, the payload executes in their context, exposing critical data and permitting limited unauthorized modifications, with impact spilling into additional connected products (scope change). No public exploit code is identified at time of analysis, and exploitation depends on both valid credentials and successful social engineering of a second person.