CVE-2026-87145 Oracle Corporation CVE debrief

Who should care

Oracle Hyperion Data Relationship Management administrators, security teams, and IT personnel responsible for patch management and vulnerability remediation. These stakeholders should assess exposure, apply patches or mitigations, and review security configurations to mitigate potential unauthorized data access and partial denial of service.

Why it matters

CVE-2026-87145 is a high-severity vulnerability in Oracle Hyperion Data Relationship Management that allows unauthenticated attackers to compromise the product, potentially leading to unauthorized data access and partial denial of service. Oracle Hyperion Data Relationship Management administrators and security teams should assess exposure and apply patches or mitigations urgently.

• Potential unauthorized data access and modification
• Partial denial of service (DOS) risk
• Need for urgent patching and mitigation
• Potential for security configuration review and updates

Technical summary

The vulnerability in Oracle Hyperion Data Relationship Management (component: Access and security) allows unauthenticated attackers with network access via HTTP to compromise the product. Successful attacks can result in unauthorized update, insert or delete access to some accessible data, unauthorized read access to a subset of accessible data, and unauthorized ability to cause a partial denial of service (partial DOS).

Defensive priority

High priority for Oracle Hyperion Data Relationship Management administrators to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure of Oracle Hyperion Data Relationship Management instances
• Apply patches or mitigations recommended by Oracle
• Monitor for unauthorized access attempts
• Review and update security configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its impacts, and affected versions. The vulnerability has a CVSS 3.1 Base Score of 7.3 (Confidentiality, Integrity and Availability impacts) and a CVSS Vector of (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The supported version that is affected is 11.2.26.0.000. Defenders should verify the affected scope, severity, and vendor guidance, and review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.