CVE-2026-87133 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Hyperion Data Relationship Management instances, especially those with high-privileged access, should assess exposure and potential impact. They should prioritize verifying exposure, applying vendor remediation, and monitoring for potential unauthorized access or data manipulation.

Why it matters

A high-severity vulnerability in Oracle Hyperion Data Relationship Management allows high-privileged attackers to compromise the product and access critical data. Defenders should prioritize verifying exposure, applying vendor remediation, and monitoring for potential unauthorized access or data manipulation.

• Potential unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data
• Potential unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data
• Possible impact on additional products
• Need for verification of exposure and remediation

Technical summary

The vulnerability exists in Oracle Hyperion Data Relationship Management, specifically in the Access and security component. It allows high-privileged attackers with network access via HTTP to compromise the product. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data, as well as unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on Oracle Hyperion Data Relationship Management instances, especially those with high-privileged access. They should also review and apply vendor remediation, and monitor for potential unauthorized access or data manipulation.

Recommended defensive actions

• Verify Oracle Hyperion Data Relationship Management instances for exposure
• Assess potential impact on additional products
• Review and apply vendor remediation
• Monitor for potential unauthorized access or data manipulation
• Perform asset inventory to identify exposed systems
• Implement compensating controls for exposed systems while remediation is scheduled
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its impact, and affected versions. Oracle's security alert page may contain additional information on remediation and mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.