What is the CVSS score of CVE-2026-62516?

CVE-2026-62516 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Demantra are affected by CVE-2026-62516?

Oracle Demantra Demand Management (versions 12.2.3-12.2.15) contains a SQL injection vulnerability enabling complete system takeover by authenticated users, exposing demand forecasting data and…

How to fix or mitigate CVE-2026-62516?

Within 24 hours, identify all instances of Oracle Demantra Demand Management running versions 12.2.3 through 12.2.15 and restrict network access to the SQL interface to business-critical personnel only. Within 7 days, deploy the Oracle July 2026 Critical Patch Update to all affected systems, beginning with production demand planning instances. Within 30 days, complete patching of remaining instances and validate remediation through version verification and functional security testing.

Oracle Demantra CVE-2026-62516

EUVD-2026-47537 HIGH

SQL Injection (CWE-89)

2026-07-21 secalert_us@oracle.com

GHSA-572c-5f49-7j59

SQLi Oracle Demantra Demand Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable SQL interface with low complexity and no user interaction; PR:L because a low-privilege authenticated account is required, and full application takeover yields C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:37 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Demantra Demand Management. Successful attacks of this vulnerability can result in takeover of Oracle Demantra Demand Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) is possible when a low-privileged, network-authenticated attacker submits crafted SQL against the Product Security component, yielding complete loss of confidentiality, integrity, and availability. Oracle rates this 8.8 (CVSS 3.1) and addresses it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 'via SQL' wording combined with the tags points to a SQL-injection-class weakness in an authenticated interface.

Technical ContextAI

Oracle Demantra is Oracle's demand management and forecasting application within the Supply Chain Management / Value Chain Planning suite, typically deployed alongside Oracle E-Business Suite and backed by an Oracle Database. The flaw resides in the 'Product Security' component and is reached 'via SQL,' which is characteristic of a SQL injection weakness (CWE-89) where user-controllable input is concatenated into database queries without proper parameterization. Because Demantra runs its business logic directly against a privileged database schema, injection at this layer can pivot from data access to full application compromise. Oracle did not publish a CWE for this entry (CWE: N/A), so the root-cause class is inferred from the description's explicit reference to SQL and the 'Information Disclosure' tag.

RemediationAI

Apply the fix delivered in the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships Demantra fixes as CPU patches rather than a standalone tagged release, and no discrete fixed version string was provided in the input, so identify the exact patch for your 12.2.x level from the CPU matrix. Until the CPU is applied, reduce exposure by restricting network access to the Demantra application tier to trusted management networks and VPNs (side effect: may break legitimate remote planner access), tightening and auditing low-privilege application accounts since PR:L credentials are the exploitation prerequisite (side effect: administrative overhead), and enabling database and web-tier query logging or a WAF/database-activity-monitoring rule to detect anomalous SQL against the Product Security component (side effect: tuning required to avoid false positives). Do not expose Demantra directly to the internet.