This vulnerability affects Oracle Hyperion Financial Reporting Server component version 11.2.25.0.000. It permits a low privileged attacker with network access via HTTP to gain unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact. There are no known exploits in the wild. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory but has not explicitly stated patch availability for this specific vulnerability in the provided advisory content.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Hyperion Financial Reporting. The impact is limited to confidentiality and integrity with low severity, and no availability impact is noted. The vulnerability is considered difficult to exploit and requires network access via HTTP with low privileges.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. However, the vendor advisory does not explicitly confirm the availability of a patch specifically for CVE-2026-70793. Users should consult the Oracle Critical Security Patch Update for August 2026 for patch availability and installation instructions. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.