This vulnerability affects Oracle Hyperion Profitability and Cost Management component Deployment in version 11.2.25.0.000. It is easily exploitable by an attacker with low privileges and network access over HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data within the product, compromising confidentiality and integrity. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact without availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability and recommends applying patches promptly.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data within Oracle Hyperion Profitability and Cost Management 11.2.25.0.000. This includes the ability to create, delete, or modify data, resulting in a significant confidentiality and integrity breach. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches from this update promptly to remediate the vulnerability. Oracle emphasizes the importance of remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.