This vulnerability affects Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. It is easily exploitable by unauthenticated attackers over the network via HTTP, enabling unauthorized access to critical or complete data accessible by the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability impact. The Oracle advisory references this vulnerability as part of their August 2026 Critical Security Patch Update but does not explicitly list a dedicated patch for this specific CVE in the provided content.

Successful exploitation results in unauthorized access to sensitive or all data accessible through Oracle Hyperion Financial Reporting 11.2.25.0.000. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector. The vulnerability is exploitable remotely without authentication, increasing risk exposure.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update, which includes numerous security fixes across Oracle products. Customers should remain on actively supported versions and promptly apply available patches to mitigate this vulnerability. The vendor advisory does not explicitly confirm a dedicated patch for CVE-2026-70752 but implies that security patches in the CSPU address such vulnerabilities. Patch status is not yet confirmed specifically for this CVE—check the Oracle advisory for the latest remediation guidance.