Oracle Demantra CVE-2026-62516

Exploitation requires network access to the Oracle Demantra Demand Management application and valid low-privilege authentication (CVSS PR:L) - this is not an unauthenticated flaw, so an attacker must already possess or obtain a low-level Demantra account. The affected code path is the 'Product Security' component reached 'via SQL,' and the target must be running an affected release in the 12.2.3-12.2.15 range. No user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factors are the credential prerequisite and network reachability of the Demantra tier; instances confined to isolated internal networks with tightly controlled accounts present materially lower risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity attack requiring only low-level authentication and no user interaction, with high impact across all three security properties - a genuinely dangerous combination for any exposed Demantra instance. However, no EPSS score, no SSVC decision data, and no KEV listing were provided, and no public proof-of-concept is identified, so real-world exploitation pressure appears low-to-unproven despite the high base score. The PR:L requirement is the main mitigating factor: an attacker needs at least valid low-privilege credentials, which limits purely anonymous internet-wide exploitation and points toward insider or post-credential-theft scenarios. Net assessment: high technical severity and a strong patch priority for organizations running Demantra, but not (yet) an emergency mass-exploitation event given the absence of KEV, EPSS, and POC signals.

An attacker who has obtained or been issued a low-privilege Demantra account reaches the Product Security component over the network and submits crafted input that is injected into a backend SQL query. By manipulating the query, they read or modify sensitive planning and configuration data and escalate to full control of the Demantra application, achieving the described takeover. No public proof-of-concept exists at time of analysis, and the low attack complexity means a working exploit would be straightforward once the injectable parameter is identified.