What is the CVSS score of CVE-2026-61041?

CVE-2026-61041 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Demantra Demand Management are affected by CVE-2026-61041?

Oracle Demantra Demand Management (versions 12.2.3-12.2.15) is vulnerable to privilege escalation attacks that allow any authenticated user to achieve complete application compromise, with potential…

How to fix or mitigate CVE-2026-61041?

Within 24 hours, inventory all Oracle Demantra deployments and identify which versions are in use (12.2.3-12.2.15 are affected), then assess criticality to supply chain operations and downstream system dependencies. Within 7 days, implement compensating controls: restrict network access to Demantra to only necessary personnel and systems; enforce principle of least privilege for all application user accounts; enable enhanced logging and alerting on privilege changes; and consider taking non-critical instances offline pending patch availability. Within 30 days, obtain and deploy the vendor security patch once Oracle releases it for all affected versions, then validate remediation with a vulnerability rescan.

Demantra Demand Management CVE-2026-61041

EUVD-2026-47257 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-64x2-c4wv-r4qg

Authentication Bypass Oracle Demantra Demand Management

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:05 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demantra Demand Management. While the vulnerability is in Oracle Demantra Demand Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Demantra Demand Management. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full application takeover in Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) lets a low-privileged, authenticated attacker with HTTP network access compromise the Product Security component and, because of a scope change, significantly impact additional connected products. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top-tier patch priority.