CVE-2026-87135 in Hyperion Data Relationship Management
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Oracle Hyperion Data Relationship Management product, specifically version 11.2.26.0.000 within the Access and security component, contains a critical vulnerability that compromises the integrity of its authentication and authorization mechanisms. This flaw allows an attacker with low privileges to exploit weaknesses in how the application handles HTTP-based requests for access control. The vulnerability stems from insufficient validation or improper enforcement of security policies during the processing of user interactions over the network. Because the attack vector is network-accessible via HTTP, a remote adversary does not need physical proximity or local system access to initiate an exploitation attempt. This characteristic significantly increases the risk surface as any entity with connectivity to the affected server can potentially target this weakness without requiring social engineering or user interaction such as clicking malicious links.
The technical nature of this flaw aligns closely with CWE-287, which describes Improper Authentication, and CWE-915, which refers to Improperly Controlled Modification of Dynamically-Determined Object Attributes. The vulnerability enables a low privileged attacker to bypass expected security constraints, effectively elevating their privileges or manipulating data they should not be able to touch. By exploiting this issue, an adversary can gain unauthorized access to critical business data stored within the Data Relationship Management system. This includes sensitive financial models, hierarchical relationships, and planning assumptions that are central to enterprise performance management processes. The ability to perform unauthorized updates, inserts, or deletes further indicates a breach of integrity controls, allowing malicious actors to alter historical records, inject false data into reporting structures, or delete essential configuration settings without detection by standard audit logs if logging is not comprehensively configured.
From an operational perspective, the impact of this vulnerability extends beyond simple data theft. The CVSS 3.1 base score of 7.1 reflects high confidentiality and low integrity impacts with no availability loss. However, in practice, unauthorized modifications to financial data can lead to severe downstream consequences including inaccurate reporting, regulatory non-compliance, and flawed strategic decision-making based on corrupted datasets. Attackers leveraging the ATT&CK technique T1078, Valid Accounts, or potentially T1136, Create Account, could establish persistent access by modifying user permissions directly through this vulnerability. This transforms a simple data breach into a potential foothold for deeper network infiltration if the Hyperion server is integrated with other enterprise systems via shared credentials or trust relationships. The lack of required user interaction means that automated scanning tools can rapidly identify and exploit vulnerable instances across an organization, leading to widespread compromise before patches are applied.
Mitigation strategies must prioritize immediate patching by Oracle as soon as a security update becomes available for version 11.2.26.0.000. In the interim, organizations should implement strict network segmentation to restrict HTTP access to only trusted administrative subnets or internal networks where possible. Web Application Firewalls can be configured with specific rulesets to detect and block anomalous request patterns associated with privilege escalation attempts against Hyperion endpoints. Additionally, enforcing multi-factor authentication for all administrative accounts adds a layer of defense that may mitigate the impact if an attacker successfully exploits this vulnerability but lacks secondary credentials. Regular auditing of user permissions and data modification logs is essential to detect any unauthorized changes promptly. Security teams should also review access control lists within the application to ensure least privilege principles are strictly enforced, minimizing the potential damage from low-privileged accounts that might be compromised through this vector.