This vulnerability affects Oracle Hyperion Financial Reporting (component: Server) version 11.2.25.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the system, but requires human interaction from a user other than the attacker. The impact includes unauthorized read and write (update, insert, delete) access to some accessible data within the product. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, with low confidentiality and integrity impacts and no availability impact. No known exploits in the wild have been reported. Oracle's advisory does not explicitly confirm a patch for this specific vulnerability but strongly recommends applying available security patches promptly.

The vulnerability allows unauthorized disclosure and modification of some data accessible through Oracle Hyperion Financial Reporting 11.2.25.0.000. An attacker can gain unauthorized read access to a subset of data and unauthorized update, insert, or delete access to some accessible data. Exploitation requires user interaction, limiting the ease of exploitation. There is no impact on system availability. No known active exploitation has been reported.

Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Although the vendor advisory does not explicitly confirm a patch specifically for CVE-2026-70759, it is part of the August 2026 Critical Security Patch Update which contains numerous security fixes. Users of Oracle Hyperion Financial Reporting 11.2.25.0.000 should apply the latest Critical Security Patch Update from Oracle to remediate this vulnerability. Patch status is not explicitly confirmed for this CVE alone; check Oracle's advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.