This vulnerability affects Oracle Hyperion Financial Management (component: Security) version 11.2.25.0.000. It is difficult to exploit and requires the attacker to have low privileged logon access to the infrastructure hosting the product. Exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Financial Management. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating local attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no impact on integrity or availability. There are no known exploits in the wild. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references a Critical Security Patch Update (CSPU) released in August 2026 that includes many patches. The affected version is explicitly stated as 11.2.25.0.000.

Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Hyperion Financial Management. The vulnerability affects confidentiality but does not impact integrity or availability. The scope change means that additional Oracle products may be significantly impacted by attacks exploiting this vulnerability.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Although the vendor advisory does not explicitly confirm a patch for CVE-2026-70841, it references the August 2026 Critical Security Patch Update which contains numerous fixes. Customers should review the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. No specific temporary mitigations are provided. Applying the latest security patches is the primary recommended action.