This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. An unauthenticated attacker with network access via HTTP can exploit this flaw, but successful exploitation requires user interaction from a third party. The impact includes unauthorized read access and unauthorized update, insert, or delete access to some data accessible by Oracle Hyperion Financial Reporting. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, limited confidentiality and integrity impact, and no availability impact. There are no known exploits in the wild. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references a Critical Security Patch Update released in August 2026 containing numerous fixes. Oracle strongly recommends applying security patches promptly.

Successful exploitation can result in unauthorized read access to some data and unauthorized modification (update, insert, delete) of some accessible data within Oracle Hyperion Financial Reporting. The impact affects confidentiality and integrity but does not affect availability. The vulnerability requires user interaction, limiting the ease of exploitation. There are no known active exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses numerous vulnerabilities across its product portfolio. Although the vendor advisory does not explicitly confirm a patch for CVE-2026-70766, Oracle strongly recommends that customers apply all relevant security patches without delay and remain on actively supported versions. Organizations using Oracle Hyperion Financial Reporting version 11.2.25.0.000 should verify patch availability via Oracle's official security alerts and apply updates promptly to mitigate this vulnerability. No alternative mitigations or workarounds are specified in the advisory.