CVE-2026-87132

CVE-2026-87132 is a flaw in the Access and security component of Oracle Hyperion Data Relationship Management (DRM) affecting supported version 11.2.26.0.000. A low-privileged attacker with network access via HTTP can exploit it, but successful attacks require interaction from a victim other than the attacker — a pattern consistent with CSRF/social-engineering-style abuse of an authenticated DRM session. A successful attack yields unauthorized access to critical data or complete access to all DRM-accessible data, plus unauthorized update, insert, or delete access to some of that data; because the vulnerability changes scope, products beyond DRM itself may also be significantly impacted. Organizations running the affected supported version of Hyperion DRM, particularly those with the web tier reachable by low-privileged users or over broader networks, are exposed. There is no known public PoC and no indication of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87132 to your Hyperion DRM 11.2.26.0.000 deployment as soon as it is available. Restrict DRM web interfaces to trusted internal networks or VPN rather than exposing them broadly, and review low-privileged account permissions to limit what a successful attack could reach. Because exploitation requires victim interaction, remind users not to follow unexpected links while authenticated to DRM, and audit logs for anomalous data access or modifications.