CVE-2026-87142

An easily exploitable, unauthenticated flaw in the Access and security component of Oracle Hyperion Data Relationship Management (DRM) allows a network attacker reachable over HTTPS to compromise the application, though successful attacks require interaction from a victim other than the attacker — a pattern consistent with a CSRF-style attack. If triggered, the flaw gives the attacker unauthorized ability to create, delete, or modify critical data (or all DRM-accessible data) and to cause a partial denial of service; confidentiality is not impacted per the CVSS vector (C:N, I:H, A:L). Only supported version 11.2.26.0.000 is listed as affected. DRM is on-premises enterprise EPM software typically deployed inside large finance organizations, so exposure is limited to those environments rather than the public internet at scale. There is no known public PoC, the CVE is not on the CISA KEV, and no exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update (CPU) that remediates this issue to Hyperion Data Relationship Management 11.2.26.0.000 as soon as your patch window allows. Because exploitation requires victim interaction and network access over HTTPS, restrict DRM web endpoints to trusted networks/VPNs and internal finance users, and brief staff on phishing-lured actions. Review DRM audit logs for unexpected data creation, deletion, or modification and for symptoms of partial service disruption.