Description
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demantra Demand Management. While the vulnerability is in Oracle Demantra Demand Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Demantra Demand Management. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Demantra Demand Management suffers from an improper access control flaw that allows a low‑privileged attacker who can reach the system via HTTP to gain unrestricted control over the application. The vulnerability is classified as CWE‑284 and, if successfully exploited, can compromise confidentiality, integrity, and availability, effectively enabling a full remote takeover of the Demantra instance.

Affected Systems

The flaw affects Oracle Demantra Demand Management, part of Oracle Supply Chain Management, for versions 12.2.3 through 12.2.15. These releases are currently supported by Oracle and are listed as vulnerable to this issue.

Risk and Exploitability

The CVSS 3.1 base score is 9.9, reflecting a high‑severity condition with availability impacts. The EPSS score is below 1 %, indicating that widespread exploitation has not been observed, and the vulnerability is not yet included in CISA’s KEV catalog. The flaw is considered easily exploitable; an attacker with network access to the HTTP interface can exploit it remotely without authentication or user interaction, making the risk high for externally exposed deployments.

Generated by OpenCVE AI on August 5, 2026 at 01:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade path released by Oracle for Oracle Demantra Demand Management versions 12.2.3 through 12.2.15 to fix the improper access control flaw.
  • Limit HTTP access to the Demantra application to trusted IP ranges or enforce VPN for remote connectivity, thereby reducing attacker exposure.
  • Enable and enforce role‑based access controls for administrative users, ensuring that users do not have unnecessary privileges and monitor access logs for anomalous activity.

Generated by OpenCVE AI on August 5, 2026 at 01:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
Title Improper Access Control in Oracle Demantra Enables Remote Takeover

Sun, 02 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Title Improper Access Control in Oracle Demantra Enables Remote Takeover

Sat, 01 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Title Oracle Demantra Demand Management Remote Code Execution Vulnerability

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Oracle Demantra Demand Management Remote Code Execution Vulnerability
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demantra Demand Management. While the vulnerability is in Oracle Demantra Demand Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Demantra Demand Management. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle demantra Demand Management
CPEs cpe:2.3:a:oracle:demantra_demand_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle demantra Demand Management
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Demantra Demand Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T14:43:52.136Z

Reserved: 2026-07-08T15:51:55.609Z

Link: CVE-2026-61041

cve-icon Vulnrichment

Updated: 2026-07-24T14:43:46.193Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T01:30:17Z

Weaknesses