CVE-2026-70975

Oracle's August 2026 Critical Patch Update (referenced in the advisory) provides the fix. Affected version is HFM 11.2.25.0.000; organizations should apply the CSP patch immediately to prevent unauthorized data exposure.