CVE-2026-87133

An easily exploitable flaw in the Access and Security component of Oracle Hyperion Data Relationship Management (DRM) allows a high-privileged attacker with network access via HTTP to compromise the product. Successful exploitation yields unauthorized access to critical data or complete read access to all DRM-accessible data, plus unauthorized insert, update, or delete access to some of that data, with no impact on availability. Because the vulnerability has a scope change, attacks may also significantly impact additional Oracle products beyond DRM itself. Only version 11.2.26.0.000 is listed as affected, and exploitation requires valid high-privileged credentials, so the realistic threat is from malicious insiders, compromised privileged accounts, or attackers who have already obtained such access. There is no known public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not on the CISA Known Exploited Vulnerabilities list.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-87133 and move off the affected 11.2.26.0.000 build. Restrict HTTP access to DRM services to trusted networks or VPN, enforce least privilege and strong authentication (including MFA where possible) for privileged DRM accounts, and review audit logs for unauthorized data reads or modifications by privileged users.