CVE-2026-87136

Executive Summary

CVE-2026-87136 is an easily exploitable, unauthenticated information-disclosure vulnerability in the Oracle Hyperion Data Relationship Management (DRM) product, specifically within the "Access and security" component, affecting the supported version 11.2.26.0.000. A remote attacker with only network access over HTTP (no credentials, no user interaction, low attack complexity) can compromise the application and obtain unauthorized access to critical data or potentially all DRM-accessible data. With a CVSS 3.1 base score of 7.5 and a sole High confidentiality impact, the flaw is a high-priority exposure for any organization running an internet- or intranet-reachable DRM instance, as master-data governance repositories frequently contain sensitive financial, organizational, and reference data.

Technical Analysis

The NVD description classifies this vulnerability under Oracle's "Access and security" component of Oracle Hyperion Data Relationship Management, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) establishes the following technical facts with certainty:

• Attack Vector: Network (AV:N). The vulnerability is reachable remotely; no local or adjacent-network foothold is required.
• Attack Complexity: Low (AC:L). No special conditions, race conditions, or victim-specific prerequisites are needed. Exploitation is repeatable and reliable.
• Privileges Required: None (PR:N). The attacker does not need any credentials — the description explicitly states "unauthenticated attacker."
• User Interaction: None (UI:N). No victim must click, confirm, or perform any action.
• Scope: Unchanged (S:U). Impact is confined to the vulnerable DRM component; the exploit does not by itself pivot the security authority to other components.
• Confidentiality: High (C:H), Integrity: None (I:N), Availability: None (A:N). Successful exploitation yields unauthorized access to critical data (disclosure only) — no data modification or denial-of-service is described.

The NVD text specifies the transport as "network access via HTTP," meaning the vulnerable attack surface is the web-facing HTTP interface of Hyperion DRM. Combined with the "Access and security" component designation and the unauthenticated nature, the flaw is best characterized at the vulnerability-class level as an access-control / authentication-enforcement weakness in which a request that should require authentication or an authorization check is processed without one, exposing protected data. That maps most naturally to CWE-284 (Improper Access Control) or the closely related CWE-306 (Missing Authentication for Critical Function); NVD does not publish an official CWE for this entry, so these are class-level attributions, not confirmed enumerations.

Scope of technical certainty. The provided intelligence contains no CNA title, no function names, no class names, no URL endpoints, no API paths, no parameter names, and no code snippets. As a result, this report deliberately does not invent specific DRM endpoints, servlet names, SOAP/REST paths, or parameter identifiers. Any such detail would be fabricated and is therefore excluded. What can be stated responsibly: exploitation occurs over HTTP against the DRM application's access/security layer and requires no authentication, producing high-confidentiality data exposure. No public proof-of-concept, exploit code, or Nuclei template is known to exist for this CVE at the time of writing.

Exploitation Scenarios

Caveat: No public PoC or exploit code is available; the following attack chain is inferred strictly from the vulnerability class (unauthenticated improper access control over HTTP) and the CVSS characteristics. It does not describe confirmed endpoints, parameters, or request structures, none of which are provided in the source data.

1. Reconnaissance / target identification. An attacker enumerates internet- or intranet-exposed Oracle Hyperion DRM deployments. Public search engines (e.g., Shodan using the dorks in the Metadata section) can fingerprint DRM via HTTP title/body strings such as "Hyperion" or "Data Relationship Management." The attacker confirms the target runs the vulnerable supported version, 11.2.26.0.000, or a deployment still on that release level.

2. Triggering the flaw class. Because the defect resides in the "Access and security" component and is reachable unauthenticated over HTTP, the attacker crafts a standard HTTP request to the affected access/security surface that bypasses or skips the authentication/authorization gate. Per CVSS (PR:N, UI:N, AC:L), no credentials and no victim action are needed; the request either returns protected content directly or reaches a code path that fails to enforce the required access check. The exact request shape (endpoint, method, parameter) is not derivable from the provided data and is not asserted here.

3. Payload / execution method (class level). At the vulnerability-class level this is a direct-request attack: the "payload" is a single unauthenticated HTTP call to the mis-enforced access/security function. It does not require code execution, file upload, or chained primitives. The attacker observes whether the response contains data that should be access-controlled.

4. Post-exploitation impact. On success, the attacker obtains unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data (CVSS C:H). Because integrity and availability are unaffected (I:N/A:N), the described exploitation is read-only disclosure — but the disclosed content may include sensitive master/reference data with high business value. There is no described lateral-movement, code-execution, or persistence capability attributable to this CVE itself.

Impact Assessment

Subscore-derived impact:

• Confidentiality (High): The single High impact. An unauthenticated remote party can read data intended to be protected by the DRM access/security layer.
• Integrity (None): No modification of data is described.
• Availability (None): No service disruption is described.
• Exploitability: Maximum — AV:N / AC:L / PR:N / UI:N yields an exploitability profile that places the effective risk well above the numeric 7.5 modifier alone.

Business context. Hyperion DRM is a master data management platform used to govern hierarchies and reference data for financial consolidation, planning, and reporting. Data exposed through a confidentiality breach here may include financial structures, organizational hierarchies, account mappings, and related governance metadata. Disclosure of such data can enable competitive intelligence gathering, downstream social-engineering, targeted financial fraud, or recon for follow-on attacks against linked EPM/Hyperion systems.

Blast radius. Any organization running an exposed, unpatched Oracle Hyperion DRM 11.2.26.0.000 instance is in scope. Because exploitation is unauthenticated and network-based, the effective blast radius is every externally reachable instance; internal-only deployments face a reduced but non-zero risk from malicious insiders or compromised internal hosts. Oracle Hyperion deployments are frequently buried behind reverse proxies and SSO — organizations should not assume SSO alone neutralizes this, since the flaw is in the product's own access/security component.

Severity: CVSS 3.1 Base 7.5 (High). EPSS has not been scored by FIRST.org (no value is fabricated here). CVE-2026-87136 is not listed in CISA KEV, and no exploit-in-the-wild evidence is available in the supplied data.

Detection Guidance

Detection below is necessarily generic because no endpoint, parameter, or signature specifics exist in the source data. Rules target the observable class behavior: unauthenticated/suspicious access to Hyperion DRM access/security paths and abnormal data-volume responses.

Sigma Rule

title: Suspicious Unauthenticated Access to Oracle Hyperion DRM
id: 9f2c1a44-7b6e-4d21-9a3e-cve202687136
status: experimental
description: Detects anomalous unauthenticated HTTP access attempts against Oracle Hyperion Data Relationship Management access/security component (CVE-2026-87136 class behavior).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87136
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: oracle_hyperion
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/Hyperion'
      - '/drm'
      - '/DataRelationshipManagement'
      - '/interop'
      - '/aps'
  selection_unauth:
    sc-status: 200
    cs-username: '-'
  filter_legit:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_path and selection_unauth and not filter_legit
falsepositives:
  - Authorized monitoring or health-check probes
  - Internal scanners
level: high

YARA Rule

rule CVE_2026_87136_Hyperion_DRM_Access
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP artifacts referencing Oracle Hyperion DRM access/security component (CVE-2026-87136). Class-level heuristic."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87136"
        date = "2026-01-01"
        severity = "high"
    strings:
        $h1 = "Oracle Hyperion" ascii wide nocase
        $h2 = "Data Relationship Management" ascii wide nocase
        $h3 = "Hyperion DRM" ascii wide nocase
        $acc1 = "Access and security" ascii wide nocase
        $ver = "11.2.26.0.000" ascii wide
    condition:
        (any of ($h*)) and (any of ($acc1, $ver))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87136 Possible Oracle Hyperion DRM Unauthenticated Access Attempt"; flow:established,to_server; http.uri; content:"/Hyperion"; http.uri; content:"/drm"; nocase; http.header; content:"Authorization"; negate; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-recon; sid:202687136; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-87136;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http" and url.path : ("*Hyperion*" or "*drm*" or "*DataRelationshipManagement*") ]
  [ http where http.response.status_code == 200 and not http.request.headers contains "Authorization" ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=pan:traffic
| eval uri=coalesce(uri, url, cs_uri_stem)
| where match(uri, "(?i)(Hyperion|/drm|DataRelationshipManagement|/aps|/interop)")
| eval auth_present=if(match(_raw, "(?i)Authorization:"), 1, 0)
| where auth_present=0 AND status=200
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as paths by src_ip
| where count > 5
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,oracle_hyperion,CVE-2026-87136,">
  <rule id="2026871" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>Hyperion|/drm|DataRelationshipManagement|/aps|/interop</match>
    <regex> 200 </regex>
    <description>CVE-2026-87136: Possible unauthenticated access to Oracle Hyperion DRM access/security component</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87136,access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix reference is confirmed, and no workarounds are published in the supplied data.

1. Immediate mitigations (reduce attack surface now).

   • Remove internet exposure of Hyperion DRM. Restrict reachability to trusted internal networks and require VPN or zero-trust access.
   • Front the application with a reverse proxy / WAF and enforce authentication and authorization at that layer for the DRM access/security surface, since the product layer is described as unauthenticated-exploitable.
   • Restrict inbound HTTP to known source ranges and monitor for anomalous unauthenticated 200 responses with large bodies.
   • Treat all data in the DRM repository as potentially exposed and consider a data-sensitivity review of what an unauthenticated read would reveal.

2. Patch / upgrade steps.

   • Monitor Oracle's Critical Patch Update (CPU) / Security Alerts channels for a fix to CVE-2026-87136. Oracle Hyperion DRM 11.2.26.0.000 is the named affected release; apply the first available Oracle-issued fix or later supported version.
   • Because no patch URL is confirmed in the source data, validate the exact fixed version directly from Oracle support advisories before deploying.

3. Long-term hardening.

   • Enforce least-privilege on DRM access/security configuration and audit its authorization rules.
   • Adopt continuous exposure monitoring (e.g., Shodan/Censys in the "reconnaissance" direction) to detect unintended DRM internet exposure.
   • Retain extended web/proxy logs to support retroactive compromise assessment if a patch and IoC set later become available.
   • Track CVE-2026-87136 in vulnerability management until a patch ships; re-score when FIRST.org publishes EPSS.

References

1. NVD — CVE-2026-87136: https://nvd.nist.gov/vuln/detail/CVE-2026-87136
2. Oracle Security Alerts / Critical Patch Updates: https://www.oracle.com/security-alerts/
3. Oracle Hyperion Data Relationship Management product information: https://www.oracle.com/performance-management/
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (verify status; not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild note: No exploit-in-the-wild evidence, no named threat-actor campaign, no CISA KEV listing, and no public PoC are associated with CVE-2026-87136 in the supplied data. No EPSS score has been assigned by FIRST.org. Any future change in these statuses should trigger re-prioritization.