CVE-2026-87135: Oracle Hyperion DRM Auth Bypass Flaw

CVE-2026-87135 Overview

CVE-2026-87135 is a vulnerability in the Oracle Hyperion Data Relationship Management product, part of the Oracle Hyperion suite. The flaw resides in the Access and security component of version 11.2.26.0.000. An authenticated attacker with low privileges and network access over HTTP can exploit the weakness to compromise the application. Successful exploitation grants unauthorized access to all data accessible through Oracle Hyperion Data Relationship Management. Attackers can also perform unauthorized update, insert, or delete operations on a subset of that data. Oracle disclosed the issue in its September 2026 Security Alert.

Critical Impact
Low-privileged network attackers can read all data accessible through Oracle Hyperion Data Relationship Management and modify a subset of it, exposing sensitive financial master data.

Affected Products

Oracle Hyperion Data Relationship Management
Oracle Hyperion (product family)
Affected version: 11.2.26.0.000

Discovery Timeline

2026-09-15 - CVE-2026-87135 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87135

Vulnerability Analysis

The vulnerability affects the Access and security component of Oracle Hyperion Data Relationship Management. The component enforces authentication and authorization decisions for users interacting with hierarchical master data. A flaw in this enforcement allows a low-privileged authenticated user to bypass intended access boundaries. The scope remains unchanged, meaning the impact is confined to the vulnerable component. Confidentiality impact is high because attackers can read all data reachable by the application. Integrity impact is limited because attackers can only modify a subset of accessible data. Availability is not affected.

Root Cause

The root cause is a broken access control condition [CWE-284] within the authorization logic of the Access and security component. Oracle has not published implementation-level details in the public advisory. The behavior is consistent with improper permission checks that fail to constrain authenticated requests to the caller's assigned role.

Attack Vector

Exploitation requires network access to the Oracle Hyperion Data Relationship Management HTTP interface. The attacker must hold valid low-privileged credentials. No user interaction is required. Attack complexity is low, which indicates a reliable exploitation path once credentials are obtained. Oracle's advisory does not list a public proof of concept, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog.

See the Oracle Security Alert September 2026 for vendor guidance. No verified exploit code is available at publication time.

Detection Methods for CVE-2026-87135

Indicators of Compromise

Unexpected read access to Data Relationship Management hierarchies, nodes, or properties by accounts that should not hold those permissions.
Unauthorized insert, update, or delete actions recorded in Data Relationship Management audit logs against master data.
HTTP requests to Data Relationship Management endpoints originating from user accounts operating outside their normal working hours or source networks.

Detection Strategies

Review Data Relationship Management audit logs for privilege-sensitive operations performed by accounts with minimal assigned roles.
Correlate authentication events with subsequent data access to identify sessions that touch data outside the user's role scope.
Baseline normal API and UI usage per user, then alert on deviations such as sudden bulk reads of hierarchies or property values.

Monitoring Recommendations

Forward Data Relationship Management application, IIS, and Windows event logs to a centralized SIEM for retention and correlation.
Enable verbose auditing on the Access and security component and on all data modification APIs.
Monitor for repeated 403-to-200 transitions on the same endpoint by the same account, which can indicate authorization probing.

How to Mitigate CVE-2026-87135

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert September 2026 to all Oracle Hyperion Data Relationship Management 11.2.26.0.000 deployments.
Inventory all Data Relationship Management instances, including non-production environments, and confirm patch status.
Rotate credentials for accounts that access Data Relationship Management, especially service and integration accounts.
Review role assignments and remove standing privileges that are not required for daily operations.

Patch Information

Oracle addressed CVE-2026-87135 in the September 2026 Security Alert. Administrators should download and apply the patch bundle listed for Oracle Hyperion Data Relationship Management from the Oracle advisory. Follow Oracle's documented pre-patch backup and validation procedure before deploying to production.

Workarounds

Restrict network access to the Data Relationship Management HTTP interface using firewall rules or a reverse proxy that limits source IP ranges.
Place the application behind a VPN or zero-trust access broker so only authenticated corporate users can reach it.
Temporarily reduce the number of low-privileged accounts with any access to Data Relationship Management until patching is complete.
Increase audit log retention and review frequency while the patch is being rolled out.

bash

# Example: restrict Data Relationship Management HTTP access to a trusted subnet
# (adjust interface, subnet, and port to match your deployment)
netsh advfirewall firewall add rule name="DRM-HTTP-Allow-Trusted" \
  dir=in action=allow protocol=TCP localport=5240 \
  remoteip=10.20.30.0/24

netsh advfirewall firewall add rule name="DRM-HTTP-Block-Other" \
  dir=in action=block protocol=TCP localport=5240