CVE-2026-87145 in Hyperion Data Relationship Management
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data as well as unauthorized read access to a subset of Oracle Hyperion Data Relationship Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management, specifically affecting version 11.2.26.0.000. This flaw represents a critical failure in authentication mechanisms, allowing unauthenticated attackers to interact with the application over HTTP without providing valid credentials. The presence of this weakness indicates that the system fails to properly verify user identity before processing requests directed at sensitive endpoints or administrative functions within the Data Relationship Management suite. Such an oversight is particularly dangerous because it removes the primary barrier between external network traffic and internal data structures, effectively exposing the core functionality of the enterprise resource planning support tool to public exploitation if accessible via a web interface.
From a technical perspective, this vulnerability enables unauthorized modifications to the database state through update, insert, or delete operations on accessible data sets. This aligns with CWE-287, which describes Improper Authentication, and suggests that specific API endpoints or administrative interfaces lack sufficient access controls. An attacker can manipulate relational data structures, potentially altering financial records, organizational hierarchies, or metadata configurations stored within the system. The ability to perform these actions without authentication signifies a severe breakdown in role-based access control logic, allowing malicious actors to inject false information or remove critical datasets that are essential for accurate business reporting and decision-making processes.
In addition to integrity violations, the vulnerability permits unauthorized read access to a subset of accessible data. This capability corresponds directly with CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor. Attackers can extract confidential financial figures, strategic plans, or proprietary organizational structures that are not intended for public consumption. The extraction of such sensitive information compromises the confidentiality aspect of the security triad and may lead to significant competitive disadvantage or regulatory non-compliance depending on the nature of the data exposed within the Hyperion environment.
Furthermore, the vulnerability includes a vector for causing a partial denial of service against Oracle Hyperion Data Relationship Management. This indicates that an unauthenticated user can consume system resources in a manner that degrades performance or renders specific services unavailable to legitimate users. While described as a partial denial of service rather than a complete outage, this impact still affects the availability component of security and can disrupt business operations by preventing authorized personnel from accessing critical financial data during peak usage times. This aspect relates to CWE-400, which involves Uncontrolled Resource Consumption, where malicious requests exhaust server resources such as memory or processing power through inefficient handling of malformed or excessive inputs.
The operational impact is substantial given the CVSS 3.1 Base Score of 7.3, reflecting high severity due to network accessibility, low attack complexity, and no required user interaction. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) confirms that the vulnerability is exploitable remotely over a network with little effort and results in limited but significant impacts across confidentiality, integrity, and availability. In terms of adversary tactics, this behavior maps to ATT&CK technique T1078, Valid Accounts, although in this case it exploits the absence of required accounts entirely, effectively bypassing authentication controls which is also consistent with initial access patterns seen in automated scanning tools targeting exposed administrative interfaces.
Mitigation strategies must prioritize immediate remediation through vendor-provided patches or updates that address the specific flaw in the Access and security component. Until a patch is applied, network-level defenses should be implemented to restrict HTTP traffic to this application exclusively from trusted IP addresses using firewalls or access control lists. Additionally, deploying a Web Application Firewall can help filter out malicious requests attempting to exploit these unauthenticated endpoints by identifying patterns associated with unauthorized data manipulation or resource exhaustion attempts. Regular security audits and penetration testing focused on authentication bypasses are recommended to ensure that no other similar weaknesses exist within the broader Oracle Hyperion ecosystem.