CVE-2026-87131 in Hyperion Data Relationship Management
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Oracle Hyperion Data Relationship Management, specifically within the Access and security component of version 11.2.26.0.000, represents a significant risk to organizational data integrity and confidentiality. This flaw is classified as an easily exploitable issue that allows low-privileged attackers with network access via HTTP to compromise the system. The technical nature of this vulnerability aligns closely with CWE-798, which involves the use of hardcoded credentials or weak authentication mechanisms, although it may also encompass elements of CWE-20 Improper Input Validation if the exploitation relies on malformed requests that bypass security controls. The presence of a scope change indicates that while the flaw resides within Oracle Hyperion Data Relationship Management, successful exploitation can lead to lateral movement or compromise of dependent systems and integrated products, thereby expanding the blast radius beyond the immediate application boundary.
From an operational perspective, this vulnerability enables unauthorized access to critical data and potentially grants complete read access to all accessible information within the Oracle Hyperion environment. Furthermore, it permits unauthorized update, insert, or delete operations on a subset of accessible data, leading to integrity violations that can distort financial reporting, analytical models, and decision-making processes inherent to enterprise performance management systems. The requirement for human interaction from a person other than the attacker suggests social engineering vectors are involved in the exploitation chain, such as phishing attacks where users are tricked into clicking malicious links or submitting credentials through deceptive interfaces. This aligns with ATT&CK technique T1566.002 Spearphishing Link and potentially T1078 Valid Accounts if the low-privileged attacker leverages stolen legitimate credentials to gain initial foothold before exploiting this specific flaw for privilege escalation or data exfiltration.
The impact of this vulnerability is severe, as reflected by a CVSS 3.1 Base Score of 7.6, indicating high severity due to significant impacts on confidentiality and integrity with no direct impact on availability. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) highlights that the attack is network-based, requires low complexity for exploitation, demands only low privileges initially but benefits from user interaction, and exhibits a changed scope where collateral damage occurs in other components. To mitigate this risk, organizations must immediately apply the latest security patches provided by Oracle to update the Hyperion Data Relationship Management component to a version that resolves these access control flaws. Additionally, implementing strict network segmentation can limit HTTP exposure of the application to only trusted subnets and enforce multi-factor authentication for all user accounts to reduce the effectiveness of social engineering attempts. Regular auditing of user permissions should be conducted to ensure adherence to the principle of least privilege, minimizing the impact if a low-privileged account is compromised.