Description
Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demand Signal Repository accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Demand Signal Repository. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification and Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an access‑control flaw that allows a low‑privileged attacker with network access to the Demand Signal Repository to create, delete, or modify critical data and to cause a hang or repeatable crash, effectively denying service. The problem manifests over HTTP, providing direct remote interaction with the internal operations component, and results in high integrity and availability impact.

Affected Systems

Oracle Demand Signal Repository, part of Oracle E‑Business Suite, is affected in versions 12.2.3 through 12.2.15. Only these releases contain the vulnerable component, which is accessed over HTTP within the internal operations subsystem.

Risk and Exploitability

The CVSS score of 8.1 indicates a serious severity, while the EPSS score of less than 1% suggests the exploit is not widely deployed at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can reach the vulnerable interface remotely, require only low privileges, and do not need a user interface, making the exploitation path straightforward.

Generated by OpenCVE AI on September 22, 2026 at 00:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Demand Signal Repository versions 12.2.3–12.2.15 to eliminate the access‑control flaw.
  • Restrict HTTP access to the internal operations component to a trusted IP range or VPN, reducing exposure to low‑privileged attackers.
  • Enable detailed logging and intrusion‑prevention monitoring for unauthorized data operations and resource‑exhaustion patterns, and alert on repeated failure or crash events.

Generated by OpenCVE AI on September 22, 2026 at 00:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
Title HTTP Access Control Flaw Enables Data Modification and DoS in Oracle Demand Signal Repository

Mon, 21 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Title Remote HTTP Access Exploit Allowing Unauthorized Data Modification and Denial of Service in Oracle Demand Signal Repository
Weaknesses CWE-284

Mon, 21 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Title Remote HTTP Access Exploit Allowing Unauthorized Data Modification and Denial of Service in Oracle Demand Signal Repository
Weaknesses CWE-284

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Low‑privileged HTTP Access Enables Unauthorized Data Modification and Denial of Service in Oracle Demand Signal Repository
Weaknesses CWE-284

Wed, 16 Sep 2026 18:15:00 +0000

Type Values Removed Values Added
Title Low‑privileged HTTP Access Enables Unauthorized Data Modification and Denial of Service in Oracle Demand Signal Repository
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demand Signal Repository accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Demand Signal Repository. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
First Time appeared Oracle
Oracle demand Signal Repository
CPEs cpe:2.3:a:oracle:demand_signal_repository:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle demand Signal Repository
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oracle Demand Signal Repository
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-21T19:11:33.732Z

Reserved: 2026-08-31T15:40:57.360Z

Link: CVE-2026-83457

cve-icon Vulnrichment

Updated: 2026-09-21T19:11:25.302Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:54.493

Modified: 2026-09-21T20:17:35.763

Link: CVE-2026-83457

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T01:00:14Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption