CVE-2026-87144: Oracle Hyperion DRM Auth Bypass Vulnerability

CVE-2026-87144 Overview

CVE-2026-87144 affects the Access and Security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.000. A low-privileged attacker with network access via HTTP can compromise the application by tricking an authenticated user into triggering a crafted request. The scope-changing nature of the flaw means successful exploitation extends impact beyond Data Relationship Management to additional Oracle Hyperion products. Attackers can gain unauthorized read access to all accessible data and limited update, insert, or delete access to a subset of data.

Critical Impact
Exploitation yields full confidentiality compromise of accessible data and partial integrity impact, with cross-product scope change affecting integrated Oracle Hyperion components.

Affected Products

Oracle Hyperion Data Relationship Management 11.2.26.0.000
Oracle Hyperion product family (via scope change)
Integrated downstream Hyperion components sharing authentication context

Discovery Timeline

2026-09-15 - CVE-2026-87144 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87144

Vulnerability Analysis

The vulnerability resides in the Access and Security component of Oracle Hyperion Data Relationship Management. Exploitation requires an authenticated low-privileged account and user interaction from a separate victim, matching a pattern consistent with cross-site request forgery or reflected client-side injection in an authenticated web session. The scope change indicates the vulnerable code path allows an attacker to influence actions or data in security domains beyond Data Relationship Management itself.

Successful exploitation yields high confidentiality impact through unauthorized access to sensitive master data managed by the application. Integrity impact is limited but real: attackers can modify a subset of records. The application does not lose availability during exploitation, so administrators may not observe operational disruption.

Oracle has not published a Common Weakness Enumeration classification for this issue. The Oracle Security Alert advisory is the authoritative technical reference.

Root Cause

The defect stems from insufficient security controls in the Access and Security component when handling HTTP-borne requests during authenticated user sessions. Because the attack requires human interaction from a user other than the attacker, the flaw likely involves trust of client-supplied content or missing anti-forgery validation on privileged operations. Oracle has not disclosed the underlying code-level root cause.

Attack Vector

An attacker authenticates to the Hyperion environment with a low-privileged account. The attacker then delivers a crafted link, form, or payload that, when opened by a targeted user, executes actions in the victim's session against the Data Relationship Management server. The scope change indicates that the attacker's actions traverse component boundaries to affect additional Oracle Hyperion services.

No public proof of concept exists for CVE-2026-87144. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-87144

Indicators of Compromise

Unexpected read operations against Data Relationship Management master data by low-privileged accounts
Modification, insertion, or deletion of Data Relationship Management records outside of scheduled change windows
HTTP requests to Data Relationship Management endpoints containing anomalous Referer headers or originating from external domains
Session activity that spans multiple Hyperion components in rapid succession from a single low-privileged principal

Detection Strategies

Inspect Data Relationship Management application logs for privileged actions initiated by accounts lacking a documented business need for those operations
Correlate authentication events with subsequent bulk data-read operations to identify session-riding patterns
Monitor web proxy and web application firewall telemetry for external referrers pointing at authenticated Hyperion endpoints

Monitoring Recommendations

Forward Oracle Hyperion access logs, web server logs, and reverse proxy logs to a centralized analytics platform for correlation
Baseline normal user behavior per role and alert on deviations such as cross-component access from low-privilege identities
Track EPSS trend data for CVE-2026-87144 to prioritize response as exploitation likelihood evolves

How to Mitigate CVE-2026-87144

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all Hyperion Data Relationship Management 11.2.26.0.000 deployments
Audit and reduce the number of accounts that hold interactive access to Data Relationship Management
Enforce short session timeouts and require re-authentication for sensitive operations
Educate administrators and business users to avoid opening untrusted links while authenticated to Hyperion consoles

Patch Information

Oracle addresses this vulnerability through the fixes documented in the Oracle Security Alert CSPUSEP2026 bulletin. Administrators should consult Oracle's security alert page for the specific patch identifiers applicable to their deployment and apply them following Oracle's recommended change-control process.

Workarounds

Restrict network reachability to Data Relationship Management to trusted management networks and VPN segments
Deploy a web application firewall in front of Hyperion with rules enforcing strict Referer and Origin header validation on state-changing requests
Isolate administrator browsers from general-purpose web browsing to reduce the chance of a victim triggering a crafted payload
Disable or remove low-privileged accounts that no longer require access to the Hyperion environment

bash

# Example: restrict access to Hyperion DRM using host firewall rules
# Replace 10.10.0.0/16 with your trusted management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP