CVE-2026-87130: Oracle Hyperion DRM Auth Bypass Vulnerability

CVE-2026-87130 Overview

CVE-2026-87130 is a high-severity vulnerability in the Oracle Hyperion Data Relationship Management product, within the Access and security component. The affected supported version is 11.2.26.0.000. An unauthenticated attacker with network access via Simple Mail Transfer Protocol (SMTP) can compromise the application, though successful exploitation is difficult. A successful attack results in unauthorized read, create, delete, or modify access to all data accessible to Oracle Hyperion Data Relationship Management.

Critical Impact
Unauthenticated network attackers can achieve full read and write access to critical Hyperion Data Relationship Management data over SMTP, impacting confidentiality and integrity of enterprise financial master data.

Affected Products

Oracle Hyperion Data Relationship Management 11.2.26.0.000
Oracle Hyperion product family (Access and security component)
Deployments exposing SMTP-related interfaces to untrusted networks

Discovery Timeline

2026-09-15 - CVE-2026-87130 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87130

Vulnerability Analysis

The flaw resides in the Access and security component of Oracle Hyperion Data Relationship Management. An unauthenticated attacker reaches the vulnerable code path over the network using SMTP as the delivery channel. Exploitation is rated as difficult, indicating that the attacker must satisfy conditions outside their direct control before the attack succeeds.

Once exploited, the vulnerability yields both read and write access to data managed by Data Relationship Management. Because this product governs master data hierarchies used across financial and enterprise performance management systems, unauthorized modification can propagate incorrect dimensions and mappings to downstream Hyperion and reporting workloads. Availability is not affected, according to the vendor advisory.

Root Cause

Oracle has not published detailed technical root-cause information for CVE-2026-87130. The advisory attributes the issue to the Access and security component and identifies SMTP as the network protocol used to reach the vulnerable code. Refer to the Oracle Security Alert CSPUSEP2026 for vendor guidance.

Attack Vector

The attack path is network-based and requires no authentication or user interaction. The attacker interacts with the Hyperion Data Relationship Management server through SMTP-facing functionality. Successful exploitation compromises the confidentiality and integrity of all data accessible to the application. Exploitation complexity is high, and no public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities (KEV) listing is available at this time. The current Exploit Prediction Scoring System (EPSS) probability is low.

No verified exploit code is available. See the Oracle Security Alert CSPUSEP2026 for vendor-provided technical context.

Detection Methods for CVE-2026-87130

Indicators of Compromise

Unexpected inbound SMTP connections to Hyperion Data Relationship Management servers from untrusted networks or non-mail infrastructure.
Anomalous read or write operations against Data Relationship Management hierarchies, versions, or node properties outside of scheduled change windows.
Application or audit log entries showing data access without a corresponding authenticated user session.

Detection Strategies

Enable and centralize Oracle Hyperion Data Relationship Management audit logs, then baseline normal SMTP-related activity to surface deviations.
Correlate network flow data with application audit trails to identify SMTP-sourced interactions that precede unauthorized data modifications.
Alert on unauthenticated or service-account-initiated changes to critical hierarchies and metadata.

Monitoring Recommendations

Monitor SMTP listener processes and inbound traffic to Hyperion hosts for volume anomalies and non-standard peers.
Track version, hierarchy, and node modification events for out-of-policy changes and route them to a security information and event management (SIEM) platform.
Review privileged account and service account usage on Hyperion servers for unexpected authentication or process activity.

How to Mitigate CVE-2026-87130

Immediate Actions Required

Apply the Oracle patch referenced in the Oracle Security Alert CSPUSEP2026 to all instances of Oracle Hyperion Data Relationship Management 11.2.26.0.000.
Restrict inbound SMTP access to Hyperion Data Relationship Management hosts to trusted mail relays and management networks only.
Audit recent hierarchy, version, and metadata changes to identify unauthorized modifications prior to patch deployment.

Patch Information

Oracle has published a fix in the Oracle Security Alert CSPUSEP2026 advisory. Administrators should follow Oracle's documented patch application procedure for Hyperion Data Relationship Management and validate patch levels against the versions listed in the advisory. Refer to the Oracle Security Alert CSPUSEP2026 for the authoritative patch bundle and installation instructions.

Workarounds

Place Hyperion Data Relationship Management servers behind network segmentation that blocks direct SMTP access from user and untrusted networks.
Disable or reconfigure SMTP-related functionality within Data Relationship Management if it is not required for business operations, per Oracle guidance.
Enforce strict egress and ingress firewall rules that constrain SMTP traffic to known mail infrastructure.

bash

# Example: restrict inbound SMTP (TCP/25) to Hyperion server from trusted relay only
# Replace 10.0.0.10 with your authorized mail relay address
iptables -A INPUT -p tcp --dport 25 -s 10.0.0.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP