CVE-2026-70912 affects Oracle Hyperion Financial Management (version 11.2.25.0.000) and involves a security flaw in the product's security component. The vulnerability allows a low-privileged attacker who has logon access to the infrastructure to compromise the application, but exploitation is difficult and requires user interaction from a third party. The scope of impact extends beyond the product itself, potentially affecting additional Oracle products. The vulnerability can result in unauthorized modification of critical data, impacting data integrity. The CVSS 3.1 vector indicates local attack vector, high attack complexity, low privileges required, user interaction required, scope changed, no confidentiality impact, high integrity impact, and no availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not provide a direct patch link or version for it specifically.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Hyperion Financial Management. The vulnerability affects data integrity but does not impact confidentiality or availability. Due to scope change, other Oracle products accessible through the compromised infrastructure may also be affected. Exploitation requires local access with valid credentials and user interaction, making it more difficult to exploit.

Oracle recommends applying security patches promptly as part of their Critical Security Patch Update program. Although no specific patch version or direct fix link is provided for CVE-2026-70912, the August 2026 Critical Security Patch Update advisory includes numerous fixes and customers should ensure they are running actively supported versions and apply all relevant patches without delay. No vendor advisory states that no action is required or that the issue is already mitigated, so patching is the recommended mitigation.