CVE-2026-87141: Oracle Hyperion DRM Auth Bypass Vulnerability

CVE-2026-87141 Overview

CVE-2026-87141 is a vulnerability in the Oracle Hyperion Data Relationship Management product within the Oracle Hyperion suite. The flaw resides in the Access and security component and affects supported version 11.2.26.0.000. A low-privileged attacker with network access over HTTP can exploit this issue to compromise confidentiality of data managed by the application. The vulnerability carries a scope change, meaning successful exploitation may impact additional products beyond Oracle Hyperion Data Relationship Management itself. Oracle published details in the Oracle Security Alert September 2026.

Critical Impact
Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data, with impact extending beyond the vulnerable component.

Affected Products

Oracle Hyperion Data Relationship Management 11.2.26.0.000
Component: Access and security
Product family: Oracle Hyperion

Discovery Timeline

2026-09-15 - CVE CVE-2026-87141 published to NVD
2026-09-16 - Last updated in NVD database
September 2026 - Oracle publishes Security Alert Advisory

Technical Details for CVE-2026-87141

Vulnerability Analysis

The flaw sits in the Access and security component of Oracle Hyperion Data Relationship Management. This component governs authentication, authorization, and permission enforcement for data managed by the application. The vulnerability allows a low-privileged authenticated user to bypass intended access restrictions over the network. Because the CVSS scope is changed, exploitation impacts data belonging to additional products that trust or integrate with Hyperion Data Relationship Management. The confidentiality impact is rated high, while integrity and availability remain unaffected. Oracle classifies exploitation as easily achievable using standard HTTP-based access.

Root Cause

Oracle has not publicly disclosed the underlying code-level defect. The Oracle Security Alert attributes the issue to the Access and security subsystem, which points to improper access control [CWE-284] or authorization enforcement gaps. The scope change indicates that the vulnerable component crosses a security authority boundary during exploitation, exposing data owned by downstream or integrated systems.

Attack Vector

Exploitation requires network access via HTTP and a valid low-privileged account on the target Hyperion Data Relationship Management instance. No user interaction is required. An authenticated attacker sends crafted HTTP requests to the application to bypass access controls in the Access and security component. The result is unauthorized read access to data across the application, including data associated with integrated Oracle Hyperion products.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS score is 0.282%.

Detection Methods for CVE-2026-87141

Indicators of Compromise

Unusual HTTP request patterns from low-privileged accounts targeting Hyperion Data Relationship Management endpoints associated with metadata browsing, hierarchy access, or property queries.
Access to data domains or hierarchies outside a user's assigned scope, visible in application audit logs.
Bulk export or enumeration activity originating from accounts that historically perform limited operations.

Detection Strategies

Enable and centralize Oracle Hyperion Data Relationship Management audit logging, then baseline normal access patterns per user role.
Correlate authentication events with subsequent data access requests to identify privilege scope violations.
Monitor web application gateways in front of Hyperion for anomalous URL parameters or request sequences targeting the Access and security component.

Monitoring Recommendations

Forward application, web server, and database audit logs from the Hyperion tier into a centralized analytics platform for cross-source correlation.
Alert on account behavior that deviates from role-based baselines, particularly read access spikes and cross-domain queries.
Track failed and successful authorization decisions to identify probing activity that precedes exploitation.

How to Mitigate CVE-2026-87141

Immediate Actions Required

Apply the fix from the Oracle Security Alert September 2026 to all Oracle Hyperion Data Relationship Management 11.2.26.0.000 deployments.
Inventory all Hyperion Data Relationship Management instances, including non-production and disaster recovery environments, and confirm patch coverage.
Review recent audit logs for signs of unauthorized data access by low-privileged accounts.
Rotate credentials for accounts that may have been exposed during the vulnerability window.

Patch Information

Oracle addressed CVE-2026-87141 in the September 2026 Security Alert. Administrators should download and apply the patch listed for Oracle Hyperion Data Relationship Management version 11.2.26.0.000 directly from Oracle Support. Follow Oracle's documented patching procedure for the Hyperion suite, including pre-patch backups and post-patch verification.

Workarounds

Restrict network access to the Hyperion Data Relationship Management HTTP interface to trusted management networks using firewall or reverse proxy controls.
Enforce least privilege on Hyperion accounts and remove unused or dormant low-privileged accounts that could serve as attack starting points.
Require multi-factor authentication in front of the Hyperion web tier where supported by the deployment architecture.
Increase audit log retention and review frequency until the patch is fully deployed across the environment.

bash

# Example: restrict access to the Hyperion HTTP interface at the host firewall
# Replace 10.0.0.0/24 with your trusted management network
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP