This vulnerability affects Oracle Hyperion Profitability and Cost Management component Deployment in version 11.2.25.0.000. It is easily exploitable remotely without authentication via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability and recommends applying patches promptly. No explicit patch version or remediation level is stated in the advisory content provided, but Oracle's CSPU typically includes fixes for such vulnerabilities.

An unauthenticated attacker with network access can fully compromise Oracle Hyperion Profitability and Cost Management 11.2.25.0.000, gaining unauthorized ability to create, delete, or modify critical data. This compromises confidentiality and integrity of all data accessible by the product. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released security patches as part of its August 2026 Critical Security Patch Update that address this vulnerability. Customers should promptly apply the relevant patches from Oracle's advisory to remediate this issue. No alternative mitigations or workarounds are specified. Patch status is not explicitly confirmed in the advisory content provided; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions.