CVE-2026-87147

Oracle Hyperion Data Relationship Management (DRM) version 11.2.26.0.000 contains a vulnerability in its Access and security component that lets a high-privileged, authenticated attacker with network access via HTTP compromise the product, though exploitation is rated as difficult (Attack Complexity: High). A successful attack results in unauthorized creation, deletion, or modification of critical data — or all DRM-accessible data — as well as unauthorized read access to that data, with significant confidentiality and integrity impact (CVSS 3.1: 7.7). Because of a scope change, successful attacks may also significantly affect additional products beyond DRM itself, likely other components of the Oracle Hyperion/EPM stack. Affected organizations are enterprises running the supported on-premises DRM release 11.2.26.0.000, typically finance and master-data-management deployments. There is no known public proof of concept and no indication of in-the-wild exploitation (not on the CISA KEV list).

What to do: Apply the Oracle Critical Patch Update that addresses this issue as soon as it is available for DRM 11.2.26.0.000 and verify no other affected versions remain in your estate. Restrict HTTP/network access to the DRM application tier to trusted administrative sources only, and tightly review and monitor high-privileged DRM accounts, since exploitation requires existing elevated credentials. Audit DRM data hierarchies and access logs for unauthorized creations, deletions, or modifications, and assess whether other Hyperion/EPM components sharing the environment are reachable given the noted scope change.