CVE-2026-70721 is a vulnerability in the Deployment component of Oracle Hyperion Profitability and Cost Management 11.2.25.0.000. It is easily exploitable by an unauthenticated attacker over HTTP, allowing compromise of the product with a significant confidentiality impact. The CVSS 3.1 base score is 8.6, indicating high severity, with attack vector network, low attack complexity, no privileges required, no user interaction, and scope changed. Successful exploitation can lead to unauthorized access to critical or all accessible data in the product. The vulnerability may also impact other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability.

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Profitability and Cost Management. The confidentiality of sensitive information is severely impacted. There is no impact on integrity or availability according to the CVSS vector. The vulnerability may also affect other Oracle products due to scope change.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.