A vulnerability in the Oracle Demand Planning product’s internal operations component permits an unauthenticated attacker who can reach the system over HTTP to compromise the application. An exploitation path requires the attacker to convince a non‑attacker human to interact with the system. When successful, the attacker can gain the ability to arbitrarily update, insert, or delete data that is normally protected, and can read a subset of data that should not be exposed.

Oracle Demand Planning versions 12.1 and 12.2 are affected. The weakness resides in the internal operations component and could potentially influence other Oracle supply chain products due to scope change.

The CVSS v3.1 base score of 6.1 indicates a medium severity with lower confidentiality and integrity impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote over HTTP; the requirement for human interaction reduces the likelihood of automated exploitation but does not eliminate the risk, especially in environments where privileged users interact with the system from untrusted networks.