This vulnerability affects Oracle Hyperion Profitability and Cost Management component Deployment in version 11.2.25.0.000. It allows an attacker with low privileges and network access over HTTP to gain unauthorized access to critical data or full data accessible by the product, and to perform unauthorized modifications such as update, insert, or delete on some data. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

The vulnerability enables unauthorized access to sensitive data within Oracle Hyperion Profitability and Cost Management and allows unauthorized modification of some data. This can result in data confidentiality breaches and partial data integrity compromise. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the available security patches promptly to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying patches without delay. Patch availability and installation instructions can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.