CVE-2026-87146 in Hyperion Data Relationship Management
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Access and security component of Oracle Hyperion Data Relationship Management, specifically affecting version 11.2.26.0.000. This flaw represents a significant weakness in the application's authentication or authorization mechanisms, allowing for unauthorized interaction with critical system resources. The nature of this defect suggests that the software fails to properly enforce access controls when processing HTTP requests, thereby permitting low-privileged users to perform actions beyond their intended permissions. In enterprise environments where Oracle Hyperion is deployed for financial planning and analysis, such a breach undermines the fundamental trust model required for sensitive data management.
From a technical perspective, the vulnerability enables an attacker with network access via HTTP to compromise the integrity of the system without requiring user interaction or complex exploitation techniques. The low attack complexity indicates that standard web-based tools can likely be used to trigger the flaw. Once exploited, the attacker gains unauthorized access to critical data and potentially complete access to all Oracle Hyperion Data Relationship Management accessible data. Furthermore, the vulnerability allows for unauthorized updates, inserts, or deletes of data within the application. This dual impact on both confidentiality and integrity highlights a severe failure in input validation and privilege separation logic within the affected component.
The operational impact of this vulnerability is substantial due to its high base score of 7.1 according to CVSS version 3.1 metrics. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) confirms that the attack vector is network-based, requires low complexity, and necessitates only low privileges for initiation. While availability remains unaffected, the high confidentiality impact signifies that sensitive financial records, strategic plans, or proprietary business intelligence could be exfiltrated by malicious actors. The limited integrity impact suggests that while data modification is possible, it may not allow for complete system control or denial of service, yet even partial unauthorized modifications can lead to significant financial discrepancies and compliance violations in regulated industries.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques related to Credential Access or Data Exfiltration if used in conjunction with other vulnerabilities, but primarily it represents a direct path for unauthorized data access under Tactic TA0001 Initial Access or TA0005 Defense Evasion depending on how the low-privilege account was obtained. The lack of user interface interaction requirement makes this particularly dangerous against automated scanning tools and persistent threat actors seeking to harvest sensitive corporate intelligence without detection through normal user activity logs.
Mitigation strategies must prioritize immediate patching by Oracle if an official update is available for version 11.2.26.0.000. In the interim, network segmentation should be enforced to restrict HTTP access to the Hyperion Data Relationship Management servers only from trusted internal subnets or through a secure web application firewall that can inspect and filter malicious payloads. Implementing strict role-based access control policies is essential to ensure that even if this vulnerability is exploited, the scope of data accessible by low-privileged accounts remains minimal. Regular audits of user permissions and monitoring for anomalous HTTP request patterns targeting security components will aid in early detection and response to potential exploitation attempts.