# CVE-2026-87132: Oracle Hyperion Data Relationship Management CSRF in Access and security

Source: https://junglewise.ai/threats/cve-2026-87132-oracle-hyperion-data-relationship-management-csrf-in-access-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87132 · Severity: high · CVSS 7.6 · Published 2026-09-15

Oracle Hyperion Data Relationship Management is a critical enterprise data management system used to define and maintain relationships between financial and operational data. A vulnerability in its access control mechanism allows a low-privileged attacker with network access to manipulate data and gain unauthorized access to sensitive information, particularly when a user can be socially engineered into clicking a malicious link or performing an unintended action.

Technologies: [Oracle Hyperion Data Relationship Management](https://junglewise.ai/threats/technologies/hyperion-data-relationship-management). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-87132 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87132 being exploited in the wild.

**How severe is CVE-2026-87132?** High severity, with a CVSS score of 7.6, published 15 September 2026.

**Which products and versions are affected?** Oracle Hyperion Data Relationship Management 11.2.26.0.000.

**Is there a fix for CVE-2026-87132?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87132 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-87132?** Check whether you run Oracle Hyperion Data Relationship Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a cross-site request forgery (CSRF) or similar client-side manipulation vulnerability in the Access and security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.000. The vulnerability requires network access (HTTP) and a low-privileged authenticated account, but exploitation depends on user interaction (social engineering or trick). The attack leverages a scope change that allows impacts beyond the directly affected product. Successful exploitation results in unauthorized read access to critical data and limited write/delete capabilities. A patch is likely available from Oracle's October 2026 Critical Patch Update (based on the published advisory date), though the referenced security alert page is currently unreachable.

## Affected products

- Oracle Hyperion Data Relationship Management 11.2.26.0.000

## Timeline

- 2026-09-15: disclosed

## References

- [https://www.oracle.com/security-alerts/cspusep2026.html](https://www.oracle.com/security-alerts/cspusep2026.html)

## Related threats

- [Oracle Hyperion Data Relationship Management denial of service in Access and security](https://junglewise.ai/threats/cve-2026-87148-oracle-hyperion-data-relationship-management-denial-of-service-in)
- [Oracle Hyperion Data Relationship Management access control bypass](https://junglewise.ai/threats/cve-2026-87147-oracle-hyperion-data-relationship-management-access-control)
- [Oracle Hyperion Data Relationship Management unauthorized access in access control](https://junglewise.ai/threats/cve-2026-87146-oracle-hyperion-data-relationship-management-unauthorized-access)
- [Oracle Hyperion Data Relationship Management authentication bypass](https://junglewise.ai/threats/cve-2026-87145-oracle-hyperion-data-relationship-management-authentication)
- [Oracle Hyperion Data Relationship Management cross-site request forgery in access control](https://junglewise.ai/threats/cve-2026-87144-oracle-hyperion-data-relationship-management-cross-site-request)