CVE-2026-87143

CVE-2026-87143 is a difficult-to-exploit vulnerability in the Access and Security component of Oracle Hyperion Data Relationship Management (DRM), affecting supported version 11.2.26.0.000. An unauthenticated attacker with network access via TCP who successfully exploits the flaw can gain unauthorized creation, deletion, or modification of critical data, or full read access to all data accessible through the DRM instance. The high CVSS 3.1 base score of 7.4 reflects high confidentiality and integrity impacts, though no availability impact, and exploitation requires high attack complexity with no privileges or user interaction. Affected organizations are enterprises running Oracle Hyperion EPM with the DRM module, typically finance and data-governance teams in large corporations. No public proof-of-concept exists and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation is not currently known to be occurring.

What to do: Apply Oracle's Critical Patch Update that remediates this flaw in Hyperion Data Relationship Management 11.2.26 as soon as it is released, prioritizing instances reachable from less-trusted network segments. Restrict TCP access to DRM service ports to trusted hosts and VPN ranges via firewall allow-listing, since the attack vector is unauthenticated network access. Review DRM audit logs for unexpected data creation, deletion, or modification by unauthenticated or anomalous sources.