This vulnerability affects Oracle Hyperion Profitability and Cost Management component Deployment in version 11.2.25.0.000. It is easily exploitable by unauthenticated attackers over the network via HTTP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact.

An attacker can gain unauthorized access to critical data and perform unauthorized creation, deletion, or modification of data within Oracle Hyperion Profitability and Cost Management. This compromises the confidentiality and integrity of the data but does not affect availability. The vulnerability is critical due to the ease of exploitation and the level of access gained.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay. Patch availability is documented in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No indication of temporary or alternative mitigations is provided, so patching is the recommended action.