This vulnerability affects Oracle Hyperion Financial Management 11.2.25.0.000 and allows an unauthenticated attacker who has logon access to the underlying infrastructure to compromise the product by gaining unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates the attack requires local access (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and results in a confidentiality impact only (C:L, I:N, A:N). The vulnerability is published and assigned CVE-2026-70916. Oracle's advisory for the August 2026 Critical Security Patch Update references this vulnerability among many others but does not explicitly state a patch for this specific version or product in the provided content.

Successful exploitation results in unauthorized read access to some data within Oracle Hyperion Financial Management 11.2.25.0.000. There is no reported impact on data integrity or system availability. The attacker must have logon access to the infrastructure where the product runs, which limits remote exploitation. The confidentiality impact is limited to a subset of accessible data.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update (CSPU) program. However, the provided advisory content does not explicitly confirm a patch availability for Oracle Hyperion Financial Management 11.2.25.0.000 for this vulnerability. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Customers should ensure they remain on actively supported versions and apply all relevant security patches without delay.