CVE-2026-87147: Oracle Hyperion DRM Auth Bypass Vulnerability

CVE-2026-87147 Overview

CVE-2026-87147 is a high-severity vulnerability in the Access and Security component of Oracle Hyperion Data Relationship Management. The affected supported version is 11.2.26.0.000. Exploitation requires a high-privileged attacker with network access over HTTP. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible by Oracle Hyperion Data Relationship Management. The flaw carries a scope change, meaning exploitation can significantly impact additional products beyond the vulnerable component. Oracle disclosed the issue through Security Alert CSPUSEP2026.

Critical Impact
A network-based attacker with high privileges can gain full read and write access to critical Oracle Hyperion Data Relationship Management data, with scope-change impact reaching adjacent products.

Affected Products

Oracle Hyperion Data Relationship Management 11.2.26.0.000
Oracle Hyperion product family (Access and Security component)
Environments integrated with Hyperion DRM through HTTP-accessible interfaces

Discovery Timeline

2026-09-15 - CVE-2026-87147 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87147

Vulnerability Analysis

The vulnerability resides in the Access and Security component of Oracle Hyperion Data Relationship Management (DRM). DRM serves as the enterprise master data management platform for Oracle Hyperion, governing hierarchies, attributes, and relationships across financial and operational data domains. A weakness in the access and security layer allows an authenticated, high-privileged actor with HTTP network access to bypass expected authorization boundaries. The scope change flag indicates the vulnerable component can influence resources managed by other security authorities. This means exploitation is not contained to DRM itself and can propagate to connected Hyperion applications and downstream data consumers. Oracle rates the confidentiality and integrity impacts as high, while availability is unaffected. Attack complexity is high, indicating the attacker must satisfy specific preconditions such as timing, configuration state, or session context to succeed.

Root Cause

Oracle has not published detailed root-cause information beyond the component identification. The flaw exists in the Access and Security subsystem, which handles authentication, authorization, and privilege enforcement for DRM users and integrations. The presence of a scope change combined with confidentiality and integrity impacts is consistent with a broken access control or authorization bypass defect that allows privileged operations against data outside the attacker's intended trust boundary.

Attack Vector

Exploitation requires network reachability to the DRM HTTP interface and a pre-existing high-privilege account. An authenticated attacker sends crafted HTTP requests to the Access and Security component to trigger the flaw. Because the attack vector is network-based and produces scope-changed impact, an insider or a compromised administrative account can pivot from DRM into other Hyperion applications and manipulate critical master data records.

No public proof-of-concept code or verified exploit is available for this vulnerability. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical details.

Detection Methods for CVE-2026-87147

Indicators of Compromise

Unexpected creation, modification, or deletion of DRM hierarchies, nodes, or properties by administrative accounts outside change-control windows.
HTTP requests to DRM Access and Security endpoints originating from unusual internal hosts or service accounts.
Audit log entries showing privilege operations that cross application boundaries into other Hyperion components.

Detection Strategies

Enable and centralize DRM audit logging, then baseline normal administrative behavior for each privileged account.
Correlate DRM HTTP access logs with authentication events to identify anomalous session reuse or privilege elevation.
Alert on master-data write operations that occur without a corresponding approved change ticket.

Monitoring Recommendations

Forward DRM application, web server, and database audit logs to a centralized SIEM for retention and correlation.
Monitor for lateral movement patterns from DRM hosts to other Hyperion or EPM application servers.
Track EPSS trend data for CVE-2026-87147 and reprioritize response if exploit availability changes.

How to Mitigate CVE-2026-87147

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all Oracle Hyperion Data Relationship Management 11.2.26.0.000 deployments.
Inventory all DRM administrative and high-privileged accounts and rotate their credentials.
Restrict network access to the DRM HTTP interface to trusted administrative subnets only.
Review recent DRM audit logs for unauthorized master-data changes.

Patch Information

Oracle addressed CVE-2026-87147 through Security Alert CSPUSEP2026. Administrators should review the alert notes for the specific patch bundle applicable to their Hyperion release train and apply it through the standard Oracle patching process. Confirm patch application by validating the DRM build number after installation.

Workarounds

Reduce the count of accounts holding DRM administrative privileges to the minimum operationally required.
Enforce multi-factor authentication and jump-host access for all privileged DRM sessions.
Segment the DRM application tier from general user networks using firewall rules that permit HTTP access only from approved management stations.
Increase audit log review cadence for the Access and Security component until patching is complete.

bash

# Example: restrict inbound HTTP access to the DRM application tier
# Replace interface, admin subnet, and DRM host with values for your environment
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -d 10.20.30.40 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -d 10.20.30.40 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -d 10.20.30.40 -j DROP
iptables -A INPUT -p tcp --dport 443 -d 10.20.30.40 -j DROP