This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It allows an attacker with low privileges and network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references a Critical Security Patch Update (CSPU) released in August 2026 containing numerous security fixes. Oracle strongly recommends applying security patches promptly to mitigate such vulnerabilities.

The vulnerability allows unauthorized access to critical data within Oracle Hyperion Financial Reporting, potentially exposing sensitive information. There is no reported impact on data integrity or system availability. The attack requires network access via HTTP and low privileges, making it relatively easy to exploit if the system is unpatched.

Oracle's August 2026 Critical Security Patch Update advisory recommends applying available security patches without delay to mitigate vulnerabilities including this one. Although no explicit patch link is provided for CVE-2026-70767, customers should ensure they are running actively supported versions and apply the latest Critical Security Patch Updates from Oracle. No vendor advisory states that no action is required or that the issue is already mitigated. Therefore, timely patching is the primary mitigation.