This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It is easily exploitable remotely without authentication via RMI, enabling attackers to compromise the system and gain unauthorized access to critical data, including the ability to create, delete, or modify such data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. The vendor advisory references a Critical Security Patch Update released in August 2026 but does not explicitly confirm patch availability for this CVE.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Hyperion Financial Reporting. This results in a complete compromise of confidentiality and integrity of the affected data. There is no impact on availability reported. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise if the system is exposed to untrusted networks.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. However, the provided advisory content does not explicitly confirm a patch for CVE-2026-70741. Organizations should monitor Oracle's official security advisories and apply any relevant patches immediately once available. Until patched, restricting network access to the RMI service and implementing network-level controls to limit exposure may reduce risk.