This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and allows a low privileged attacker who has logon access to the infrastructure where the product runs to compromise it. The attack can result in unauthorized access to critical data or full access to all data accessible by the product. The CVSS 3.1 vector indicates the attack requires local access (AV:L), low complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), scope change (S:C), and impacts confidentiality (C:H) without affecting integrity or availability. The vulnerability is classified under CWE-284 (Improper Access Control). Oracle has published a Critical Security Patch Update advisory for August 2026 referencing this vulnerability but does not explicitly confirm patch availability for this specific CVE in the provided content.

Exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Hyperion Financial Management. The vulnerability affects confidentiality but does not impact integrity or availability. The scope change indicates potential impact on additional Oracle products beyond Hyperion Financial Management.

Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. The August 2026 Critical Security Patch Update advisory references this vulnerability among many others. However, the specific patch availability for CVE-2026-70847 is not explicitly stated in the provided advisory content. Users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation information. Until a patch is confirmed, restrict access to the infrastructure where Oracle Hyperion Financial Management executes to trusted users only.