CVE-2026-87145

CVE-2026-87145 is an easily exploitable flaw in the Access and security component of Oracle Hyperion Data Relationship Management (DRM) that allows an unauthenticated attacker with network access via HTTP to compromise the application. Successful attacks can result in unauthorized update, insert, or delete access to some DRM-accessible data, unauthorized read access to a subset of that data, and a partial denial of service. The only supported version listed as affected is 11.2.26.0.000. The vulnerability carries a CVSS 3.1 base score of 7.3 (high) with low impact across confidentiality, integrity, and availability. There is no known public proof of concept and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that addresses this flaw as soon as your patch cycle allows, since no fixed version number beyond the affected 11.2.26.0.000 is specified. Restrict HTTP access to the DRM web tier via firewall rules or VPN so only trusted finance/IT users can reach it, since the flaw requires no authentication. Review DRM application and access logs for unexpected data modifications or unexplained service degradation.