CVE-2026-87130

Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and Security component that allows an unauthenticated, remote attacker with network access via SMTP to compromise the product. Oracle rates the vulnerability as difficult to exploit (attack complexity: high), but successful attacks can result in unauthorized creation, deletion, or modification of critical data — or all DRM-accessible data — as well as unauthorized read access to that data (CVSS 3.1 base score 7.4, high confidentiality and integrity impact, no availability impact). Only the supported release 11.2.26.0.000 is listed as affected. Exposure is limited to enterprise on-premises performance management deployments, and the SMTP-reachable attack surface is typically internal rather than internet-facing. No public proof of concept exists, the CVE is not on CISA's KEV, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update release that remediates this CVE and upgrade off 11.2.26.0.000 as soon as the fixed version is available. Restrict SMTP and network access to the DRM server to trusted mail relays and internal subnets to shrink the unauthenticated attack surface. Review DRM audit and change logs for any unauthorized data creation, deletion, or modification, since exploitation requires no credentials and directly threatens master-data integrity.