CVE-2026-87138

CVE-2026-87138 is an easily exploitable flaw in the Access and security component of Oracle Hyperion Data Relationship Management (DRM) that allows an unauthenticated attacker with network access to the product's SOAP interface to cause a complete denial of service. An attacker sends specially crafted requests over SOAP, requiring no privileges or user interaction, which can hang or repeatedly crash the DRM service, taking it offline. The impact is limited to availability — no confidentiality or integrity impact — but the affected service becomes unusable for finance and data governance teams that rely on it. Only the supported version 11.2.26.0.000 is listed as affected. There is no known public proof of concept and the vulnerability is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation is not currently observed in the wild.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE to all Oracle Hyperion Data Relationship Management 11.2.26.0.000 installations as soon as it is available. In the interim, restrict network access to DRM SOAP services to trusted internal subnets via firewalls or reverse-proxy allowlists, since exploitation requires network reachability to the SOAP interface. Monitor DRM service logs and process health for unexplained hangs or repeated crashes, which would indicate attempted abuse.