CVE-2026-87138: Oracle Hyperion DRM DOS Vulnerability

CVE-2026-87138 Overview

CVE-2026-87138 is a denial-of-service vulnerability in Oracle Hyperion Data Relationship Management, part of the Oracle Hyperion product family. The flaw resides in the Access and security component and affects version 11.2.26.0.000. An unauthenticated attacker with network access via Simple Object Access Protocol (SOAP) can trigger a hang or a frequently repeatable crash, producing a complete denial of service. The weakness is categorized under [CWE-400] Uncontrolled Resource Consumption. Oracle disclosed the issue in the Oracle Security Alert CSPUSEP2026.

Critical Impact
Unauthenticated network attackers can crash or hang Oracle Hyperion Data Relationship Management through crafted SOAP requests, disrupting enterprise master data management operations.

Affected Products

Oracle Hyperion Data Relationship Management 11.2.26.0.000
Oracle Hyperion product family (Access and security component)
Deployments exposing the SOAP interface to network-reachable clients

Discovery Timeline

2026-09-15 - CVE-2026-87138 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87138

Vulnerability Analysis

The vulnerability affects the Access and security component of Oracle Hyperion Data Relationship Management (DRM). DRM handles enterprise master data governance, so an outage of the service disrupts data synchronization across financial and analytical systems. The flaw is reachable over the network by unauthenticated clients through the SOAP interface, requiring no user interaction. Successful exploitation causes a hang or a frequently repeatable crash, resulting in a complete denial of service. Confidentiality and integrity are not impacted; only availability is affected. The weakness aligns with [CWE-400] Uncontrolled Resource Consumption, indicating that specially crafted SOAP traffic consumes resources the service does not properly bound.

Root Cause

The root cause is uncontrolled resource consumption in request handling within the Access and security component. Oracle has not published implementation details, but [CWE-400] behavior typically stems from missing limits on input size, iteration counts, memory allocation, or thread usage during SOAP request parsing or authentication processing.

Attack Vector

Exploitation requires only network reachability to the SOAP endpoint of the DRM service. No credentials, privileges, or user interaction are needed. An attacker submits crafted SOAP messages that force the server into a hang state or a repeatable crash condition. Because the impact is a complete denial of service, repeated requests can hold the service offline for the duration of the attack.

No verified proof-of-concept code has been published. See the Oracle Security Alert CSPUSEP2026 for vendor guidance and fixed versions.

Detection Methods for CVE-2026-87138

Indicators of Compromise

Unexpected termination or unresponsiveness of the Oracle Hyperion DRM service process, followed by automatic or manual restarts.
Spikes in inbound SOAP traffic from a small number of source addresses targeting the DRM endpoint.
Application logs showing repeated exceptions, thread exhaustion, or memory pressure in the Access and security component.

Detection Strategies

Monitor DRM service health with synthetic transactions that exercise the SOAP endpoint and alert on latency or availability regressions.
Inspect web application firewall or reverse proxy logs for malformed or oversized SOAP requests targeting DRM URIs.
Correlate service crash events with preceding network traffic to identify repeatable request patterns tied to the outage.

Monitoring Recommendations

Enable verbose logging on the DRM Access and security component and forward logs to a centralized analytics platform for review.
Track process restart counts, JVM heap usage, and thread pool saturation on hosts running Hyperion DRM.
Alert on any unauthenticated SOAP request volume that exceeds normal operational baselines.

How to Mitigate CVE-2026-87138

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUSEP2026 as soon as they are validated in a test environment.
Restrict network access to the DRM SOAP interface so that only trusted application tiers can reach it.
Review DRM service availability monitoring to ensure operators are alerted immediately if the service hangs or crashes.

Patch Information

Oracle addresses this vulnerability in the Oracle Security Alert CSPUSEP2026. Administrators should download and install the vendor-supplied update for Oracle Hyperion Data Relationship Management 11.2.26.0.000 as described in the advisory. Verify version strings after patching and re-run availability tests against the SOAP endpoint.

Workarounds

Place the DRM SOAP endpoint behind a web application firewall or API gateway that enforces request size, rate, and schema validation.
Use network segmentation and firewall rules to limit SOAP access to specific internal source addresses.
Configure connection, thread, and memory quotas on the application server hosting DRM to reduce the blast radius of resource exhaustion.

bash

# Example: restrict inbound access to the DRM SOAP port to trusted subnets
# Replace <drm_port> and <trusted_subnet> with environment-specific values
iptables -A INPUT -p tcp --dport <drm_port> -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <drm_port> -j DROP