CVE-2026-87144 Oracle CVE debrief

Who should care

Defenders responsible for Oracle Hyperion Data Relationship Management systems, particularly those with network access and human interaction, should assess potential exposure and impact.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact due to the vulnerability's high CVSS score and potential for data breaches.

• Potential unauthorized access to critical data
• Possible complete access to all accessible data
• Unauthorized update, insert, or delete access to some data
• Need for verification of system configurations and access controls

Technical summary

The vulnerability in Oracle Hyperion Data Relationship Management (component: Access and security) allows a low-privileged attacker with network access via HTTP to compromise the product. Successful attacks require human interaction and can result in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete access to some data. The CVSS score is 7.6 with a vector of (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems with network access and human interaction.

Recommended defensive actions

• Verify exposure by checking system configurations and access controls.
• Assess potential impact on critical data and system integrity.
• Implement compensating controls to limit unauthorized access and data manipulation.
• Monitor for suspicious activity and implement incident response plans.
• Review vendor patch guidance for Oracle Hyperion Data Relationship Management.
• Conduct an exposure review to identify potentially affected systems.
• Perform asset inventory to track affected product deployments.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.6 and vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). The vulnerability affects Oracle Hyperion Data Relationship Management, specifically version 11.2.26.0.000. Defenders should verify exposure by checking system configurations and access controls, focusing on network access and human interaction. Evidence from the CVE Program and NVD suggests that successful attacks require human interaction and can result in unauthorized access,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.