CVE-2026-87134

CVE-2026-87134 is an access-control vulnerability in the Access and security component of Oracle Hyperion Data Relationship Management (DRM), affecting supported version 11.2.26.0.000. A low-privileged attacker with network access to the DRM service over TCP can easily exploit the flaw to gain unauthorized access to critical data, potentially exposing all data accessible through the DRM installation. The CVSS 3.1 base score is 7.7 (high) with a scope change, meaning successful attacks can also significantly impact additional Oracle Hyperion products beyond DRM itself; only confidentiality is impacted (no integrity or availability impact). Organizations running the affected version of this on-premises enterprise performance management component are at risk of broad sensitive financial/hierarchy data exposure. There is no known public proof of concept and the flaw is not on the CISA KEV catalog, so exploitation status is none known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87134 to your Hyperion Data Relationship Management 11.2.26.0.000 environment as soon as it is available. Restrict TCP network access to DRM services to trusted users and subnets via firewall rules, and review and minimize low-privileged DRM accounts that could be leveraged. Audit DRM access logs for unusual bulk data reads or access outside expected roles to detect any attempted abuse.