Oracle Demand Planning CVE-2026-101547

Exploitation requires luring a victim user into interacting with attacker-supplied content (UI:R) directed at the Oracle Demand Planning Internal Operations component over HTTP; it cannot be triggered by the attacker alone. No authentication is required of the attacker (PR:N), but success depends on a separate human victim performing the interaction, which is the primary limiting factor. Only Oracle E-Business Suite environments running Demand Planning versions 12.1 or 12.2 with the web interface network-reachable are exposed; there is no availability impact and data confidentiality/integrity impact is partial, bounding the damage even on successful exploitation.

This is a moderate-severity issue (CVSS 3.1 base 6.1) that should be treated as a routine patch-cycle priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity, unauthenticated exploitation, but the mandatory user-interaction requirement (UI:R) and the limited, partial Confidentiality and Integrity impacts (C:L/I:L, no Availability impact) materially cap real-world damage. The scope change (S:C) combined with UI:R, low partial C/I impact and no availability impact is the classic signature of a reflected cross-site-scripting-style flaw where the attacker's payload executes in the context of a victim who clicks a crafted link, and the description's statement that attacks 'may significantly impact additional products' aligns with this scope change. No EPSS score, CISA KEV listing, public POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified; absence of these is not evidence of safety but does argue against widespread automated exploitation. Note a data conflict: the input Tag 'Authentication Bypass' contradicts both the vector and the description - this is an unauthenticated flaw requiring victim interaction, not an authentication bypass - so that tag should be disregarded. Overall this is a legitimate but not urgent finding for environments running the affected Oracle E-Business Suite Demand Planning module.

An attacker crafts a malicious HTTP link or payload targeting the Oracle Demand Planning Internal Operations component and lures an authenticated user (or any user with access) into clicking it. When the victim interacts, the payload executes in their session context, allowing the attacker limited read access to some Demand Planning data and limited unauthorized update, insert, or delete of other data, with impact potentially crossing into additional products due to the scope change. No public exploit code was identified at time of analysis.