This vulnerability affects Oracle Hyperion Financial Reporting server component version 11.2.25.0.000. It is difficult to exploit and requires the attacker to have logon access to the infrastructure hosting the product. Exploitation can result in unauthorized creation, deletion, or modification of critical or accessible data, and unauthorized read access to a subset of accessible data. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N, reflecting local attack vector, high complexity, low privileges, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. No known exploits in the wild have been reported. The vendor advisory is part of Oracle's August 2026 Critical Security Patch Update, which includes many patches across Oracle products. However, no explicit patch link or fix version is provided for this specific vulnerability in the advisory.

An attacker with low privileges and logon access to the infrastructure can compromise Oracle Hyperion Financial Reporting, potentially leading to unauthorized creation, deletion, or modification of critical or accessible data, and unauthorized read access to some data. This impacts data confidentiality and integrity but does not affect availability. The vulnerability is rated medium severity with a CVSS score of 5.3. There are no reports of active exploitation in the wild.

Oracle recommends applying security patches promptly as part of their Critical Security Patch Update program. Although no specific patch link is provided for CVE-2026-70784, customers should ensure they are running actively supported versions and apply the August 2026 Critical Security Patch Update without delay. The vendor advisory does not indicate that no action is required or that the issue is already mitigated. Therefore, applying the latest security patches from Oracle is the recommended mitigation.