This vulnerability affects Oracle Hyperion Profitability and Cost Management component Deployment in version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges and network access via HTTP, allowing compromise of the product and unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact. The vulnerability may impact other Oracle products due to scope change. Oracle’s August 2026 Critical Security Patch Update advisory references this vulnerability and recommends applying patches promptly.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Profitability and Cost Management. The vulnerability affects confidentiality but does not impact integrity or availability. The scope change indicates potential impact on additional Oracle products beyond the initially affected component.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant patches without delay to mitigate the risk. Oracle recommends remaining on actively supported versions and promptly applying security patches. No alternative mitigations or workarounds are specified in the advisory.