CVE-2026-87145: Oracle Hyperion DRM Auth Bypass Vulnerability

CVE-2026-87145 Overview

CVE-2026-87145 is a vulnerability in the Oracle Hyperion Data Relationship Management product within the Oracle Hyperion suite. The flaw resides in the Access and security component of version 11.2.26.0.000. An unauthenticated attacker with network access over HTTP can exploit the vulnerability without user interaction. Successful exploitation allows unauthorized update, insert, or delete access to some accessible data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service.

Critical Impact
Remote unauthenticated attackers can modify, read, and disrupt Oracle Hyperion Data Relationship Management data over HTTP without user interaction.

Affected Products

Oracle Hyperion Data Relationship Management 11.2.26.0.000
Component: Access and security
Oracle Hyperion product family

Discovery Timeline

2026-09-15 - CVE-2026-87145 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
2026-09 - Oracle Security Alert published (Oracle Security Alert Advisory)

Technical Details for CVE-2026-87145

Vulnerability Analysis

The vulnerability affects the Access and security component of Oracle Hyperion Data Relationship Management (DRM). DRM is Oracle's enterprise data governance and master data management platform for financial hierarchies. The flaw exposes the application to remote, unauthenticated abuse over HTTP. An attacker can reach the vulnerable functionality directly across the network without credentials or user interaction. Because the affected component enforces access and security controls, exploitation undermines the trust boundary that governs read and write operations on managed data.

Successful exploitation yields three distinct outcomes. First, the attacker gains unauthorized write access enabling update, insert, or delete operations against a subset of DRM-accessible data. Second, the attacker obtains unauthorized read access to a subset of DRM data. Third, the attacker can trigger a partial denial of service in the DRM service. The combined confidentiality, integrity, and availability impact affects the reliability of downstream financial reporting and consolidation workflows that depend on DRM hierarchies.

Root Cause

Oracle has not disclosed the specific root cause in the public advisory. The description indicates the defect resides in the Access and security component and permits unauthenticated network access to protected operations. This pattern is consistent with a broken access control or authentication bypass condition in an HTTP-facing endpoint.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires no privileges and no user interaction. Any DRM 11.2.26.0.000 instance reachable from an untrusted network segment is a viable target. Refer to the Oracle Security Alert Advisory for technical details.

No verified proof-of-concept code is publicly available for CVE-2026-87145.
See the Oracle Security Alert for vendor guidance.

Detection Methods for CVE-2026-87145

Indicators of Compromise

Unexpected HTTP requests to Oracle Hyperion DRM endpoints from external or non-administrative source addresses.
Unauthorized modifications, insertions, or deletions in DRM hierarchies, nodes, or properties without a corresponding change ticket.
DRM service availability degradation, request timeouts, or resource-exhaustion events without a scheduled cause.
Unauthenticated session activity or anomalous read access patterns against DRM data stores.

Detection Strategies

Enable and review DRM application audit logs for changes to hierarchies, nodes, and property values, correlating with authenticated user identity.
Deploy web application firewall (WAF) inspection in front of DRM HTTP interfaces to flag requests that bypass authentication headers or session cookies.
Baseline normal DRM API traffic volume and alert on deviations that could indicate scripted exploitation or partial DoS attempts.

Monitoring Recommendations

Forward DRM application, IIS, and operating system logs to a centralized SIEM for correlation with network telemetry.
Monitor authentication failure patterns and requests to Access and security endpoints for anomalies.
Track database write operations against DRM tables and alert on changes originating outside approved application service accounts.

How to Mitigate CVE-2026-87145

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert Advisory for Oracle Hyperion Data Relationship Management 11.2.26.0.000.
Restrict network access to DRM HTTP interfaces to trusted management networks and named administrative hosts only.
Review DRM audit logs for unauthorized data modifications since the DRM service was last exposed to untrusted networks.
Rotate credentials and service account secrets used by DRM if audit evidence indicates suspicious activity.

Patch Information

Oracle has published fixes as part of its security alert program. Administrators should consult the Oracle Security Alert Advisory and apply the vendor-supplied updates for Oracle Hyperion Data Relationship Management version 11.2.26.0.000. No verified public proof-of-concept exists at the time of publication, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Workarounds

Place DRM behind a reverse proxy or WAF that enforces authentication before requests reach the application.
Segment DRM servers into a restricted network zone with strict ingress firewall rules limited to authorized clients.
Disable or block internet exposure of DRM HTTP interfaces until the vendor patch is applied.
Increase logging verbosity on the Access and security component to support post-incident review.

bash

# Example: restrict DRM HTTP access to a trusted administrative subnet
# Replace 10.10.20.0/24 with your approved management network
New-NetFirewallRule -DisplayName "Restrict Oracle Hyperion DRM HTTP" \
  -Direction Inbound \
  -Protocol TCP \
  -LocalPort 80,443 \
  -RemoteAddress 10.10.20.0/24 \
  -Action Allow