CVE-2026-87130 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Hyperion Data Relationship Management deployments, including system administrators, security teams, and IT managers, should assess exposure and prioritize remediation efforts. This involves verifying the current exposure status, restricting network access to the affected product, and applying vendor-provided patches or updates. Additionally, defenders should review compensating controls for exposed systems and monitor for

Why it matters

CVE-2026-87130 is a high-severity vulnerability in Oracle Hyperion Data Relationship Management that allows unauthenticated attackers to potentially access and modify critical data. Defenders responsible for this product should verify exposure, restrict network access, and prioritize patching.

• Potential unauthorized data modification or access
• Possible disruption of critical data management processes
• Need for verification of current exposure and remediation status

Technical summary

The vulnerability, located in the Access and security component of Oracle Hyperion Data Relationship Management 11.2.26.0.000, is difficult to exploit and allows unauthenticated attackers with network access via SMTP to compromise the product. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data, as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data.

Defensive priority

Defenders should prioritize verifying exposure and applying remediation, focusing on restricting network access to the affected product.

Recommended defensive actions

• Verify and restrict network access to Oracle Hyperion Data Relationship Management
• Apply vendor-provided patches or updates
• Monitor for suspicious activity via SMTP
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE and NVD records provide details on the vulnerability, its impacts, and affected versions. Oracle's security alert also provides relevant information. The vulnerability is difficult to exploit and allows unauthenticated attackers with network access via SMTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data, as well as unauthorized access to data

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.