CVE-2026-87146: Oracle Hyperion DRM Auth Bypass Vulnerability

CVE-2026-87146 Overview

CVE-2026-87146 is a vulnerability in the Oracle Hyperion Data Relationship Management product, within the Access and Security component. The affected supported version is 11.2.26.0.000. A low-privileged attacker with network access via HTTP can exploit this flaw to compromise Oracle Hyperion Data Relationship Management. Successful exploitation grants unauthorized access to critical data, or complete access to all data accessible by the product. Attackers can also gain unauthorized update, insert, or delete access to a subset of data. The vulnerability is easily exploitable and requires no user interaction.

Critical Impact
Authenticated attackers with low privileges can read all data accessible to Oracle Hyperion Data Relationship Management and modify a subset of that data over the network.

Affected Products

Oracle Hyperion Data Relationship Management
Component: Access and security
Version: 11.2.26.0.000

Discovery Timeline

2026-09-15 - CVE-2026-87146 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87146

Vulnerability Analysis

The vulnerability resides in the Access and Security component of Oracle Hyperion Data Relationship Management. Oracle categorizes the flaw as easily exploitable by a low-privileged attacker with network access over HTTP. The attack does not require user interaction and executes within the same security scope as the target application. Successful exploitation compromises confidentiality of all data accessible to the application and allows partial integrity impact through unauthorized write operations. Availability is not affected.

Root Cause

Oracle has not publicly disclosed the root cause. The Access and Security component governs authentication and authorization decisions within Oracle Hyperion Data Relationship Management. The flaw allows an authenticated user to exceed their intended access boundaries and interact with data or functionality outside their privilege scope. This behavior is consistent with a broken access control weakness.

Attack Vector

Exploitation occurs remotely over HTTP against the Oracle Hyperion Data Relationship Management web interface. The attacker must hold valid low-privilege credentials for the application. After authenticating, the attacker issues crafted HTTP requests to the vulnerable endpoints exposed by the Access and Security component. Because the flaw does not require elevated privileges or user interaction, exploitation can be automated once credentials are obtained through phishing, credential reuse, or insider access.

No public proof-of-concept, exploit code, or CISA KEV listing is available for CVE-2026-87146 at this time. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-provided technical detail.

Detection Methods for CVE-2026-87146

Indicators of Compromise

Authenticated HTTP requests from low-privilege accounts accessing Oracle Hyperion Data Relationship Management administrative or high-value endpoints.
Unexpected read, insert, update, or delete operations logged against sensitive dimensions, hierarchies, or metadata records.
Anomalous session activity from accounts that historically access limited scopes of Hyperion data.

Detection Strategies

Review Oracle Hyperion Data Relationship Management application and audit logs for privilege boundary violations by non-administrative accounts.
Correlate HTTP access logs from the Hyperion web tier with authentication events to identify low-privilege sessions performing broad data reads.
Baseline normal query and modification patterns per user role, then alert on deviations affecting the Access and Security component.

Monitoring Recommendations

Forward Hyperion application, web server, and database audit logs to a centralized SIEM for continuous analysis.
Enable Oracle Hyperion Data Relationship Management audit trails for all read and write operations affecting critical hierarchies.
Monitor for spikes in HTTP request volume or error rates against the Hyperion application after the CVE publication date.

How to Mitigate CVE-2026-87146

Immediate Actions Required

Apply the fix referenced in the Oracle Security Alert CSPUSEP2026 as soon as it is available for your environment.
Inventory all Oracle Hyperion Data Relationship Management deployments running version 11.2.26.0.000 and prioritize internet-facing or business-critical instances.
Rotate credentials for low-privilege Hyperion accounts and enforce strong authentication to reduce the pool of exploitable identities.

Patch Information

Oracle has published guidance for this issue in the Oracle Security Alert CSPUSEP2026. Administrators should follow Oracle's patch application procedures for Hyperion Data Relationship Management version 11.2.26.0.000 and validate the update in a non-production environment before rollout. See the Oracle Security Alert CSPUSEP2026 for the authoritative patch matrix and instructions.

Workarounds

Restrict network access to the Oracle Hyperion Data Relationship Management web interface using firewall rules or a reverse proxy that enforces source IP allowlists.
Reduce the number of accounts holding any privilege within Hyperion Data Relationship Management, applying least-privilege principles until patching is complete.
Require multi-factor authentication for all users of the Hyperion application to raise the cost of credential-based exploitation.

bash

# Configuration example: restrict HTTP access to Hyperion DRM at the reverse proxy
# (illustrative nginx snippet - adapt to your environment)
location /oracle-hyperion-drm/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://hyperion-drm-backend;
}