CVE-2026-87144 in Hyperion Data Relationship Management
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management, specifically affecting version 11.2.26.0.000. This flaw represents a significant risk to organizations relying on this enterprise performance management platform for financial planning and analysis. The core technical issue involves an authentication or authorization bypass mechanism that allows low-privileged attackers with network access via HTTP to compromise the system. Unlike vulnerabilities requiring high-level privileges, this defect lowers the barrier to entry significantly by permitting exploitation from accounts with minimal initial permissions. However, the attack vector is not entirely automated; it necessitates human interaction from a user other than the attacker. This social engineering aspect implies that the vulnerability likely involves a cross-site scripting scenario or similar web-based exploit where an unsuspecting administrator or privileged user must perform a specific action, such as clicking a malicious link or submitting crafted input, to trigger the security breach.
The operational impact of this vulnerability is severe due to its potential for scope change and high confidentiality impacts. Successful exploitation does not merely affect the immediate Oracle Hyperion Data Relationship Management instance but can significantly impact additional products within the broader Oracle ecosystem. This lateral movement capability suggests that the compromised session or data structure may be leveraged to access interconnected systems, databases, or applications integrated with the hyperion environment. The primary consequences involve unauthorized access to critical business data and complete access to all accessible information managed by the platform. Furthermore, the integrity of the system is at risk, as attackers can perform unauthorized updates, inserts, or deletes on sensitive financial records. This dual impact on confidentiality and integrity means that an attacker could not only steal proprietary financial models but also alter them, leading to potentially catastrophic decision-making errors based on corrupted data.
From a classification perspective, this vulnerability aligns with CWE-287, which covers Improper Authentication, and CWE-918, Server-Side Request Forgery (SSRF), depending on the specific mechanism used to achieve scope change. The requirement for human interaction places it within the domain of social engineering attacks often associated with CWE-601 URL Redirection to Untrusted Site. In terms of offensive security frameworks, this behavior maps closely to MITRE ATT&CK technique T1534, Internal Spearphishing, where an attacker uses a compromised or low-level account to trick another user into executing malicious actions that escalate privileges or expand access. The CVSS 3.1 base score of 7.6 reflects the high confidentiality impact and the relatively easy exploitability despite the need for user interaction. The vector string AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N clearly indicates a network-accessible flaw with low complexity, requiring low privileges but human intervention, resulting in significant scope expansion and data compromise without affecting availability.
Mitigation strategies must address both the technical configuration gaps and the procedural controls surrounding user interactions. Oracle has likely released patches for version 11.2.26.0.000 that should be applied immediately to close the authentication or authorization bypass flaw. Organizations should also implement strict input validation and output encoding on all web-facing components of Hyperion Data Relationship Management to prevent script injection or malicious request formatting. Since human interaction is a prerequisite for exploitation, security awareness training is critical; users must be educated to recognize suspicious links and requests that deviate from normal operational workflows. Additionally, implementing Web Application Firewalls can help detect and block anomalous HTTP traffic patterns associated with this exploit before they reach the application server. Network segmentation should also be reviewed to limit the potential scope change, ensuring that even if Hyperion is compromised, lateral movement to other critical systems is restricted by robust firewall rules and zero-trust architecture principles.