CVE-2026-87144

Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and security component that allows a low-privileged, authenticated attacker with HTTP network access to compromise the product, with successful attacks requiring human interaction from a person other than the attacker (consistent with a CSRF-style or social-engineering-assisted attack). Because the vulnerability changes scope, a successful attack can also significantly impact products beyond DRM itself. The impact is high confidentiality and low integrity: an attacker can gain unauthorized read access to critical data or all DRM-accessible data, and can also insert, update, or delete some of that data. Only DRM 11.2.26.0.000 is listed as affected. There is no evidence of public exploitation: no public PoC is known and the CVE is not on the CISA KEV list.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87144 and move off 11.2.26.0.000 per Oracle's CPU guidance. Restrict HTTP access to DRM endpoints to trusted networks and VPN users, and review logs for anomalous read or write activity by low-privilege accounts. Because exploitation requires user interaction, remind users not to open unsolicited links or approve unexpected requests while authenticated to Hyperion applications.