CVE-2026-87146

CVE-2026-87146 is a vulnerability in the Access and security component of Oracle Hyperion Data Relationship Management (DRM), affecting supported version 11.2.26.0.000. A low-privileged (authenticated) attacker with network access via HTTP can exploit it easily to compromise the DRM application. A successful attack can result in unauthorized read access to critical data — up to complete access to all DRM-accessible data — as well as unauthorized update, insert, or delete access to some of that data. Organizations running Oracle Hyperion DRM 11.2.26.0.000, typically large enterprises using it for financial hierarchy and master data management, are affected. There is no known public proof of concept and no evidence of in-the-wild exploitation; the flaw is not on the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that remediates this issue for Hyperion DRM 11.2.x as soon as it is available in your patch cycle. In the meantime, restrict HTTP/network access to DRM web endpoints to trusted VPN or internal networks and review DRM audit logs for unusual data reads or modifications by low-privilege accounts. Enforce least-privilege role assignments so compromised low-tier accounts have minimal reach.