This vulnerability affects the Deployment component of Oracle Hyperion Profitability and Cost Management version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can lead to unauthorized access to critical or all accessible data and can cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

An attacker with low privileges and network access can compromise Oracle Hyperion Profitability and Cost Management 11.2.25.0.000, resulting in unauthorized access to sensitive or all accessible data and the ability to cause a partial denial of service. This compromises confidentiality and availability of the affected system.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch availability and installation instructions can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.