CVE-2026-87141

Executive Summary

CVE-2026-87141 is an easily exploitable access-control vulnerability in Oracle Hyperion Data Relationship Management (DRM), specifically within the "Access and security" component, affecting version 11.2.26.0.000. A low-privileged attacker with network access over HTTP can exploit the flaw to obtain unauthorized access to critical data or complete access to all DRM-accessible data, with a scope change indicating impact may extend to additional products. The CVSS 3.1 base score is 7.7 (High), driven entirely by High confidentiality impact (C:H) with no integrity or availability impact, and there is currently no public proof-of-concept, no Nuclei template, no exploit code, no CISA KEV listing, and no vendor patch confirmation.

Technical Analysis

Oracle Hyperion Data Relationship Management is an enterprise master data management (MDM) product used to govern hierarchical reference data — chart of accounts, cost centers, organizational hierarchies, and similar master data structures — across financial consolidation, planning, and reporting environments. Its "Access and security" component governs authentication, authorization, role assignment, and permission enforcement across the DRM application.

CVE-2026-87141 is classified by Oracle as an access-control flaw in that component. Based on the NVD description alone, the demonstrable facts are:

• The attack vector is network-based (AV:N) and delivered over HTTP, meaning the vulnerable surface is an HTTP-exposed interface within the DRM web application.
• The attack requires only low privileges (PR:L). An authenticated user holding a minimally-privileged account can trigger the flaw — no administrative rights are required.
• No user interaction is required (UI:N), so exploitation does not depend on tricking a legitimate user into performing an action.
• Attack complexity is low (AC:L), and Oracle explicitly characterizes the vulnerability as "easily exploitable."
• The scope changes (S:C), which in CVSS terms means a successful exploit can affect resources beyond the vulnerable component's own security authority — here, "additional products" sharing DRM data or trust relationships.
• The sole impact is to confidentiality (C:H); integrity and availability are explicitly unaffected (I:N/A:N).

The most consistent interpretation of these characteristics is a broken or missing authorization check on an HTTP request handler in the DRM access-and-security layer. In such a class of flaw, an authenticated low-privileged user can craft or replay requests that the server fails to adequately validate against the caller's assigned privileges, causing it to return data the caller is not entitled to. This aligns precisely with the C:H-only, PR:L, AC:L, S:C profile: no data is modified and no service is taken down, but protected data is disclosed, and the disclosure can cascade to integrated systems.

Insufficient technical detail available: The NVD description and CNA title do not disclose the specific HTTP endpoint, parameter, request method, or code path involved. No function names, class names, URL paths, or API parameters are provided by the vendor, and none should be assumed. The exact enforcement gap (e.g., missing role check, privilege-context confusion, horizontal vs. vertical privilege escalation) cannot be determined from the available data. Any reader should treat the mechanism above as the vulnerability class implied by the CVSS profile and component designation, not as a confirmed implementation detail.

No CWE was assigned in the provided data, which is common for Oracle Critical Patch Update entries that are intentionally kept sparse to limit attacker advantage prior to patch availability.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (improper access control in an HTTP-facing enterprise web component) and the CVSS metrics. No public PoC is available; the chain below is a class-level reconstruction, not a validated exploit.

1. Reconnaissance and target identification. An attacker enumerates internet- or intranet-exposed Oracle Hyperion DRM instances. DRM deployments are typically reachable over HTTPS on organization-internal networks or, less commonly, via internet-facing gateways. Identifiable signals include the DRM web application login interface, WebLogic-fronted HTTP responses, and application titles referencing Hyperion or Data Relationship Management. Shodan-style discovery (http.title:"Hyperion", http.html:"Data Relationship Management") identifies externally reachable instances. Because PR:L applies, the attacker must possess at least one valid low-privileged account — obtained through provisioning, credential reuse, or a separate foothold — making this primarily an insider, supply-chain-partner, or post-compromise escalation vector rather than an unauthenticated zero-click internet attack.

2. Triggering the flaw. Using the low-privileged account, the attacker authenticates to the DRM web application and issues HTTP requests targeting the access-and-security functionality. The vulnerability class (improper access control) implies that the server fails to correctly enforce the caller's permission set on a request that exposes protected DRM data. Because complexity is low and no user interaction is required, exploitation amounts to sending requests the application should reject but does not. The specific endpoint and parameters are not disclosed and must not be invented.

3. Payload / execution method (class level). At the vulnerability-class level, the "payload" is a legitimate-looking but unauthorized HTTP request. There is no memory-corruption or code-execution component (I:N/A:N confirm no write or denial impact). The attacker manipulates request content — such as identifiers or selectors within the request — to reference DRM objects they are not authorized to view, relying on the missing or incorrect authorization check to have the server return those objects. This is a horizontal or vertical privilege-escalation pattern, not remote code execution.

4. Post-exploitation impact. Successful exploitation yields unauthorized read access to critical data or complete access to all DRM data accessible through the vulnerable component (C:H). Due to the scope change (S:C), the exposure is not self-contained: compromised DRM hierarchy, account, and metadata can be leveraged against "additional products" that consume DRM data or trust its output — for example downstream financial consolidation, planning, or reporting systems. Exfiltrated master data (account structures, organizational hierarchies, cost-center mappings) is highly sensitive, aids lateral movement and further targeted attacks, and carries significant regulatory and competitive-exposure weight. There is no data-tampering or service-disruption impact.

Impact Assessment

CVSS 3.1: 7.7 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

• AV:N — remotely exploitable over the network; no physical or adjacent access.
• AC:L — no specialized conditions; Oracle terms it "easily exploitable."
• PR:L — requires a low-privileged account; materially raises the bar versus an unauthenticated flaw but is trivial for insiders, partners, or anyone who has already obtained a foothold.
• UI:N — no victim interaction required; automatable at scale once a credential is held.
• S:C — impact crosses a security boundary; DRM data exposure can affect other products, broadening blast radius beyond the DRM instance itself.
• C:H / I:N / A:N — High confidentiality impact; no integrity or availability impact.

Business impact. Hyperion DRM often underpins financial reporting and regulatory submissions. Unauthorized access to its master data can expose financial hierarchies, account structures, and organizational data — supplying attackers with a detailed map of the enterprise for follow-on targeting. The scope change means a single DRM compromise can propagate confidentiality exposure into dependent systems, complicating containment and breach-scoping.

Affected systems. Oracle Hyperion Data Relationship Management version 11.2.26.0.000. Organizations running that specific release in any environment where a potentially untrusted or minimally-privileged user holds DRM credentials are in scope.

Detection Guidance

Caveat: No endpoint, parameter, or request signature is disclosed for this CVE. The detections below are behavior-based heuristics for improper-access-control abuse in an HTTP-facing enterprise web application. They require local tuning — particularly the request-path and data-volume thresholds — and should be treated as starting points, not CVE-specific signatures.

Sigma Rule

title: Potential Unauthorized Data Access in Oracle Hyperion DRM
id: 8f2c1a44-9b71-4e2d-b0c3-2026drm0001
status: experimental
description: Detects patterns consistent with improper access-control abuse against Oracle Hyperion Data Relationship Management (CVE-2026-87141) - low-privileged authenticated sessions retrieving abnormal volumes of protected data over HTTP.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87141
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.ta0007
logsource:
  category: web
  product: oracle_hyperion
detection:
  selection_app:
    cs-uri-stem|contains:
      - '/Hyperion'
      - '/drm'
      - '/DRM'
  selection_success:
    sc-status: 200
  selection_anomaly:
    # local tuning required: unusually large response or abnormal request rate for a low-priv role
    sc-bytes|gte: 1000000
  condition: selection_app and selection_success and selection_anomaly
falsepositives:
  - Legitimate bulk data exports by authorized administrators
  - Scheduled reporting jobs
level: medium

YARA Rule

rule CVE_2026_87141_Hyperion_DRM_AccessControl_Abuse
{
    meta:
        description = "Heuristic detection of exploitation artifacts referencing Oracle Hyperion DRM access-control abuse (CVE-2026-87141)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87141"
        date = "2026-01-01"
        severity = "high"

    strings:
        $drm1 = "Data Relationship Management" nocase
        $drm2 = "Hyperion DRM" nocase
        $cve  = "CVE-2026-87141" nocase
        $hint1 = "access and security" nocase
        $hint2 = "DRM" ascii wide

    condition:
        filesize < 5MB and
        ( $cve or
          ( any of ($drm*) and $hint1 ) or
          ( $hint2 and 1 of ($drm1) ) )
}

Suricata IDS Rule

alert http any any -> any any ( \
  msg:"CVE-2026-87141 Oracle Hyperion DRM Access-Control Abuse Attempt"; \
  flow:established,to_server; \
  http.host; content:"Hyperion"; nocase; \
  http.uri; content:"DRM"; nocase; \
  http.method; content:"GET"; \
  threshold: type both, track by_src, count 20, seconds 60; \
  reference:cve,CVE-2026-87141; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87141; \
  classtype:attempted-recon; \
  sid:202687141; rev:1; )

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [ network where http.host : "Hyperion*" and
      http.request.method : "GET" and
      url.path : "*DRM*" ]
  [ network where http.response.status_code : 200 and
      http.response.body.bytes > 1000000 and
      url.path : "*DRM*" ]

Splunk SPL Query

index=web (uri_path="*Hyperion*" OR uri_path="*DRM*" OR uri_path="*drm*")
status=200
| stats count AS reqs, sum(bytes) AS total_bytes, dc(uri_path) AS paths
        by src_ip, user, session_id
| where reqs > 20 AND total_bytes > 5000000
| sort - total_bytes
| table src_ip, user, session_id, reqs, total_bytes, paths

Wazuh OSSEC Rule

<group name="web,oracle_hyperion,access_control,">
  <rule id="2026871" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>Hyperion|Data Relationship Management|DRM</match>
    <regex> 200 </regex>
    <description>Potential Oracle Hyperion DRM improper access-control activity (CVE-2026-87141) - abnormal data access</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_anomaly,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range beyond 11.2.26.0.000 is currently available for CVE-2026-87141.

1. Immediate mitigations

• Restrict network exposure of Oracle Hyperion DRM to trusted, least-privileged networks only; place instances behind access-controlled reverse proxies or zero-trust gateways rather than exposing HTTP interfaces broadly. The attack vector is network/HTTP, so reducing reachability directly reduces risk.
• Enforce strong least-privilege on all DRM accounts. Because PR:L is required, minimizing the number and permission footprint of low-privileged accounts reduces the pool of exploitable credentials.
• Mandate MFA and enforce short session lifetimes on DRM authentication to blunt credential-based triggering.
• Apply egress and data-volume monitoring on the DRM HTTP interface to detect abnormal bulk data retrieval consistent with confidentiality-only abuse.
• Monitor Oracle Critical Patch Update (CPU) advisories and Oracle Security Alerts for patches addressing this CVE; apply as soon as available.

2. Patch / upgrade steps

• No patch is confirmed available. When Oracle publishes a CPU/Security Alert covering CVE-2026-87141, upgrade Oracle Hyperion Data Relationship Management 11.2.26.0.000 to the patched release (or apply the referenced patch) during a controlled maintenance window.
• Schedule the upgrade as high priority given the High severity (7.7), easy exploitability, and absence of compensating controls.

3. Long-term hardening

• Integrate Oracle CPU cycles into a formal vulnerability-management SLA; apply all DRM security patches within defined timelines.
• Continuously inventory and tier DRM data by sensitivity, and apply data-access auditing so unauthorized reads are logged and alerted.
• Deploy the detection rules above with local tuning and validate them against normal DRM bulk-export behavior to control false positives.
• Review scope-change trust relationships: identify which "additional products" consume DRM data and treat them as part of the blast radius for future authorization reviews.

References

1. NVD — CVE-2026-87141: https://nvd.nist.gov/vuln/detail/CVE-2026-87141
2. Oracle Critical Patch Update / Security Alerts (monitor for the advisory referencing this CVE): https://www.oracle.com/security-alerts/
3. Oracle Hyperion Security documentation / Data Relationship Management: https://docs.oracle.com/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-87141 not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor evidence: None available. No public PoC, no Nuclei template, no exploit code, no CISA KEV listing, and no EPSS score (not yet scored by FIRST.org) were present for CVE-2026-87141 at the time of writing.