CVE-2026-87137

CVE-2026-87137 is a vulnerability in the Access and security component of Oracle Hyperion Data Relationship Management (DRM), affecting only the supported version 11.2.26.0.000. A low-privileged attacker with network access via HTTP can exploit it, but successful attacks require human interaction from a person other than the attacker (per the CVSS vector PR:L/UI:R), suggesting the attacker must induce an authorized user to take some action, as in a CSRF- or XSS-style scenario. A successful attack compromises Oracle Hyperion DRM and, due to a scope change, may significantly impact additional products beyond DRM itself. The impact is unauthorized read access to critical data or all DRM-accessible data, plus unauthorized update, insert, or delete access to some of that data (CVSS 3.1 base score 7.6, High; confidentiality high, integrity low, no availability impact). There is no known public proof of concept and the CVE is not in the CISA Known Exploited Vulnerabilities catalog, so exploitation status is none known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87137 to any Hyperion DRM environment running 11.2.26.0.000, and verify the patched version after upgrade. Restrict HTTP access to DRM endpoints to internal networks or VPN, review DRM user roles to enforce least privilege for low-privileged accounts, and remind users to be wary of unsolicited links or requests, since exploitation requires victim interaction. Monitor DRM audit logs for anomalous data reads or unauthorized inserts/updates/deletes.