Description
Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Planning. While the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demand Planning accessible data as well as unauthorized access to critical data or complete access to all Oracle Demand Planning accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-08-18
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in Oracle Demand Planning allows a low privileged attacker with network access via HTTP to exploit the system and gain unauthorized ability to create, delete, or modify critical data, and to access all accessible data. The flaw can be leveraged without user interaction and results in high confidentiality and integrity impacts.

Affected Systems

The affected product is Oracle Demand Planning, versions 12.1 and 12.2, released by Oracle Corporation as part of the Oracle Supply Chain suite.

Risk and Exploitability

The CVSS v3.1 score of 9.6 indicates a very high level of risk. The vulnerability is easily exploitable (access vector network, low attack complexity, local privileges). The EPSS score is < 1%, indicating a very low estimated probability of exploitation in practice, but the lack of a KEV listing does not reduce the urgency, as the potential scope change could affect additional Oracle products.

Generated by OpenCVE AI on August 21, 2026 at 05:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑provided security update for Oracle Demand Planning versions 12.1 and 12.2.
  • Restrict HTTP access to Oracle Demand Planning to trusted networks or IP ranges and enforce network segmentation.
  • Enable logging and monitoring for unauthorized or anomalous data manipulation attempts and review alerts regularly.

Generated by OpenCVE AI on August 21, 2026 at 05:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Remote Data Manipulation via HTTP in Oracle Demand Planning
Weaknesses CWE-284

Wed, 19 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Title Remote Vulnerability in Oracle Demand Planning Allows Data Manipulation and Privilege Escalation
Weaknesses CWE-284

Wed, 19 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Title Remote Vulnerability in Oracle Demand Planning Allows Data Manipulation and Privilege Escalation
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Planning. While the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demand Planning accessible data as well as unauthorized access to critical data or complete access to all Oracle Demand Planning accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle demand Planning
CPEs cpe:2.3:a:oracle:demand_planning:12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:demand_planning:12.2:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle demand Planning
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Demand Planning
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-25T03:56:34.560Z

Reserved: 2026-08-04T22:06:34.601Z

Link: CVE-2026-70846

cve-icon Vulnrichment

Updated: 2026-08-24T14:58:00.221Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-18T21:17:40.430

Modified: 2026-08-25T04:18:18.327

Link: CVE-2026-70846

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T05:15:05Z

Weaknesses