CVE-2026-87131 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Hyperion Data Relationship Management, network security, and data access controls should assess exposure and potential impact, prioritizing verification and remediation efforts.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact on additional products, focusing on data access controls and network security due to the high CVSS score and potential for data breaches.

• Potential unauthorized access to critical data
• Possible update, insert, or delete access to some data
• Scope change impacting additional products
• Requires verification of exposure and remediation steps

Technical summary

The vulnerability in Oracle Hyperion Data Relationship Management 11.2.26.0.000 allows low-privileged attackers with network access via HTTP to compromise the product. Successful attacks require human interaction and can result in unauthorized access to critical data or update, insert, or delete access to some data. The CVSS 3.1 Base Score is 7.6 with Confidentiality and Integrity impacts. This vulnerability affects the Access and security component of Oracle Hyperion Data Relationship Management. The vulnerability has a high CVSS score, indicating a significant risk to affected systems. Defenders should prioritize verifying exposure and assessing potential impact on additional products, with a focus on data

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on additional products, with a focus on data access controls and network security.

Recommended defensive actions

• Verify exposure of Oracle Hyperion Data Relationship Management 11.2.26.0.000
• Assess potential impact on additional products
• Review data access controls and network security
• Monitor for unauthorized access or data modifications
• Apply vendor patches or updates according to the vendor's guidance
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. However, the scope of affected products and specific remediation steps require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.