This vulnerability affects Oracle Hyperion Financial Reporting component Server in version 11.2.25.0.000. It is exploitable remotely without authentication over HTTP and allows unauthorized reading of a subset of accessible data. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact. The vendor advisory references a Critical Security Patch Update for August 2026 with many patches but does not explicitly confirm a patch for this CVE in the provided text.

Successful exploitation results in unauthorized read access to some data within Oracle Hyperion Financial Reporting, potentially exposing sensitive information. There is no impact on data integrity or availability according to the CVSS vector. The vulnerability is remotely exploitable without authentication, increasing risk if the affected version is exposed to untrusted networks.

Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. The vendor advisory references a Critical Security Patch Update released in August 2026 containing numerous patches. However, the provided advisory content does not explicitly confirm a patch for CVE-2026-70754. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Until a patch is confirmed and applied, restrict network access to the affected Oracle Hyperion Financial Reporting instance to trusted users only.