Hyperion Profitability And Cost Management
Monthly
Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial data to full unauthorized read and write access through an authorization bypass flaw in its Deployment component, exploitable over HTTP by any low-privileged authenticated user. The dual high-severity impacts - complete confidentiality loss and full integrity compromise covering unauthorized creation, deletion, and modification of all PCM-accessible data - make this a significant threat to enterprise financial management environments. No public exploit has been identified at time of analysis, and CISA KEV listing is not confirmed.
Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial planning data to low-privileged network attackers through its Deployment component over HTTP. Tagged as an authentication bypass, the vulnerability permits a credentialed user to gain complete read access to all data accessible within the application and perform limited unauthorized insert, update, or delete operations, without requiring user interaction or elevated privileges beyond an initial low-level account. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity (AC:L) means a skilled attacker with any valid credential could exploit this reliably.
Full system takeover in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by a high-privileged, network-authenticated attacker via HTTP against the Deployment component, resulting in complete confidentiality, integrity, and availability compromise. Disclosed as part of Oracle's August 2026 Critical Security Update (CPU) and registered in ENISA EUVD (EUVD-2026-61690), with no confirmed active exploitation or public exploit code at time of analysis. The PR:H prerequisite significantly constrains the attacker population to insiders, compromised administrator accounts, or actors with prior lateral movement to admin-level access.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by any low-privileged attacker with network access over HTTP targeting the Deployment component. The combination of a high confidentiality impact and an 'Authentication Bypass' tag from EUVD suggests the flaw may allow authenticated users to escalate access beyond their authorization level, potentially exposing all financial and operational data managed by the platform. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has addressed this in the August 2026 Critical Security Patch Update.
Unauthenticated data compromise in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 (Deployment component) lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the application. Tagged as an authentication bypass and rated CVSS 3.1 9.1, it was reported by Oracle and addressed in the August 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data exposure in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application, with scope change enabling lateral data exposure across additional Oracle Hyperion ecosystem products. The vulnerability resides in the Deployment component and is exploitable over HTTP without user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the Authentication Bypass tag from ENISA EUVD signals a likely authorization control weakness that warrants priority patching in enterprise environments.
Unauthenticated remote exploitation of Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows network attackers to gain complete read access to all application-managed financial data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Deployment component and carries a CVSS scope change, meaning successful exploitation may expose data from additional interconnected Oracle Hyperion products sharing the same infrastructure. No public exploit code or active exploitation has been confirmed, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N profile makes this trivially repeatable once an attacker identifies the vulnerable endpoint.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial data to full unauthorized read and write access through an authorization bypass flaw in its Deployment component, exploitable over HTTP by any low-privileged authenticated user. The dual high-severity impacts - complete confidentiality loss and full integrity compromise covering unauthorized creation, deletion, and modification of all PCM-accessible data - make this a significant threat to enterprise financial management environments. No public exploit has been identified at time of analysis, and CISA KEV listing is not confirmed.
Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial planning data to low-privileged network attackers through its Deployment component over HTTP. Tagged as an authentication bypass, the vulnerability permits a credentialed user to gain complete read access to all data accessible within the application and perform limited unauthorized insert, update, or delete operations, without requiring user interaction or elevated privileges beyond an initial low-level account. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity (AC:L) means a skilled attacker with any valid credential could exploit this reliably.
Full system takeover in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by a high-privileged, network-authenticated attacker via HTTP against the Deployment component, resulting in complete confidentiality, integrity, and availability compromise. Disclosed as part of Oracle's August 2026 Critical Security Update (CPU) and registered in ENISA EUVD (EUVD-2026-61690), with no confirmed active exploitation or public exploit code at time of analysis. The PR:H prerequisite significantly constrains the attacker population to insiders, compromised administrator accounts, or actors with prior lateral movement to admin-level access.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by any low-privileged attacker with network access over HTTP targeting the Deployment component. The combination of a high confidentiality impact and an 'Authentication Bypass' tag from EUVD suggests the flaw may allow authenticated users to escalate access beyond their authorization level, potentially exposing all financial and operational data managed by the platform. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has addressed this in the August 2026 Critical Security Patch Update.
Unauthenticated data compromise in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 (Deployment component) lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the application. Tagged as an authentication bypass and rated CVSS 3.1 9.1, it was reported by Oracle and addressed in the August 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data exposure in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application, with scope change enabling lateral data exposure across additional Oracle Hyperion ecosystem products. The vulnerability resides in the Deployment component and is exploitable over HTTP without user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the Authentication Bypass tag from ENISA EUVD signals a likely authorization control weakness that warrants priority patching in enterprise environments.
Unauthenticated remote exploitation of Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows network attackers to gain complete read access to all application-managed financial data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Deployment component and carries a CVSS scope change, meaning successful exploitation may expose data from additional interconnected Oracle Hyperion products sharing the same infrastructure. No public exploit code or active exploitation has been confirmed, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N profile makes this trivially repeatable once an attacker identifies the vulnerable endpoint.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.