CVE-2026-87128 in Hyperion Data Relationship Management
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management, specifically affecting version 11.2.26.0.000. This flaw represents a critical failure in authentication mechanisms that allows unauthenticated attackers to interact with the application over HTTP without providing valid credentials. The presence of this weakness indicates a significant lapse in access control enforcement at the network layer or within the web server configuration handling requests for sensitive administrative functions. By exploiting this vulnerability, an attacker can bypass standard security controls and gain direct entry into the system's core data management capabilities. This type of flaw is commonly associated with CWE-287 Improper Authentication or CWE-306 Missing Authentication for Critical Function, where the application fails to verify the identity of users attempting to perform privileged operations.
The operational impact of this vulnerability is severe due to its high exploitability and broad scope. An attacker with network access can leverage easily exploitable conditions to compromise the integrity and confidentiality of the entire Oracle Hyperion Data Relationship Management environment. Successful exploitation leads to unauthorized creation, deletion, or modification of critical data stored within the system. Furthermore, it grants complete read access to all accessible data, effectively resulting in a total loss of confidentiality for sensitive financial and relational information managed by the platform. The CVSS 3.1 base score of 9.1 reflects this high severity, driven primarily by the High impacts on both Confidentiality and Integrity while Availability remains unaffected. This profile aligns with ATT&CK techniques such as T1078 Valid Accounts if credentials are later harvested from the compromised data, or more directly T1528 Steal Application Access Token if session tokens are intercepted during the unauthenticated interaction phase.
The ability to modify critical data poses a direct threat to business continuity and financial reporting accuracy. Since Oracle Hyperion Data Relationship Management is often used for enterprise performance management and consolidation of financial statements, unauthorized alterations can lead to significant regulatory compliance issues and distorted organizational insights. The lack of authentication requirement means that the attack surface is exposed to any entity capable of reaching the server over HTTP, including potential remote attackers on public networks if the service is not strictly isolated behind additional network-level firewalls or reverse proxies with strict access control lists. This underscores a critical need for immediate remediation as the vulnerability allows for full system compromise without prior authentication steps that would typically mitigate such risks.
Mitigation strategies must focus on both immediate containment and long-term architectural improvements. Oracle should apply the latest security patches released to address this specific flaw in version 11.2.26.0.000 or upgrade to a supported, patched release where access controls are properly enforced. In the interim, organizations should restrict network access to the Hyperion Data Relationship Management server by configuring firewalls to allow connections only from trusted IP addresses and subnets. Additionally, deploying an external reverse proxy with strict authentication requirements can shield the backend application from direct unauthenticated exposure. It is also advisable to disable HTTP if HTTPS is available and enforced throughout the environment to ensure encryption in transit, although this does not replace the need for fixing the underlying authentication bypass vulnerability. Regular security audits and penetration testing should be conducted to verify that access control mechanisms are functioning as intended across all components of the Hyperion suite.