CVE-2026-87141 in Hyperion Data Relationship Management
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management, specifically affecting version 11.2.26.0.000. This flaw represents a critical weakness in the application's authentication or authorization mechanisms, allowing for unauthorized access by attackers who possess only low-level privileges. The exploitability vector is network-based via HTTP, which significantly lowers the barrier to entry for potential adversaries as it does not require physical proximity or complex social engineering tactics beyond initial network reachability. The presence of this vulnerability indicates a fundamental failure in enforcing least-privilege principles within the application's security architecture, permitting users with minimal credentials to escalate their access rights and interact with sensitive system resources that should remain restricted.
From an operational perspective, the impact of this vulnerability is severe due to its high confidentiality implications. A successful exploitation allows an attacker to gain unauthorized access to critical data stored within the Oracle Hyperion Data Relationship Management environment. The scope change noted in the advisory suggests that compromising this specific component can lead to a cascading failure across additional products integrated with or dependent on the Data Relationship Management system. This lateral movement capability means that the breach is not isolated but has the potential to compromise the integrity and confidentiality of broader enterprise data ecosystems, including financial reporting structures, consolidation models, and intercompany eliminations managed by the platform. The CVSS 3.1 base score of 7.7 reflects this high severity, driven primarily by the complete access to all accessible data rather than immediate system control or denial of service.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-862 Missing Authorization if the flaw allows actions without proper checks. The attack vector corresponds to ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials obtained through low-level access or credential stuffing to move laterally within the network. Furthermore, given that HTTP is the transport protocol and the impact involves data exfiltration, it may also relate to CWE-200 Information Exposure if sensitive configuration details are leaked during the exploitation process. The ability of a low privileged user to compromise critical systems highlights a significant gap in role-based access control implementation within the application's security model.
Mitigation strategies must prioritize immediate patching and network segmentation until updates can be applied. Oracle should release the latest security patches for version 11.2.26.0.000, which are expected to address the underlying code flaws responsible for this privilege escalation or authorization bypass. In the interim, organizations should enforce strict firewall rules to restrict HTTP access to the affected component solely from trusted management networks rather than exposing it broadly across the enterprise network. Implementing Web Application Firewalls with specific rule sets designed to detect and block anomalous authentication patterns related to this vulnerability can provide an additional layer of defense. Additionally, auditing existing user roles and permissions is crucial to ensure that no unnecessary low-privileged accounts have access to sensitive modules within the Data Relationship Management suite. Regular security assessments and penetration testing focusing on privilege escalation paths will help identify similar weaknesses in other integrated systems before they are exploited by malicious actors seeking to compromise financial data integrity.