This vulnerability affects Oracle Hyperion Financial Management version 11.2.25.0.000 and allows an unauthenticated attacker with network access via HTTP to read a subset of accessible data without authorization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact without integrity or availability impact. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not provide a direct patch link for it. The advisory emphasizes the importance of applying available patches promptly to avoid exploitation.

Successful exploitation results in unauthorized read access to a subset of data within Oracle Hyperion Financial Management. There is no impact on data integrity or availability. The vulnerability can be exploited remotely without authentication, increasing the risk of data exposure over the network.

Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among many others and recommends applying the provided security patches without delay. Although no specific patch link for CVE-2026-70911 was provided, users should ensure they apply the latest Critical Security Patch Update from Oracle covering Oracle Hyperion Financial Management version 11.2.25.0.000. Remaining on actively supported versions and timely patching is the primary mitigation.