Oracle Demand Planning CVE-2026-70852

No special configuration is required beyond network reachability of the Oracle Demand Planning Internal Operations component over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the Oracle advisory characterization of the vulnerability as 'easily exploitable' confirm this is a default-configuration flaw - no non-standard feature flag, specific deployment mode, or application setting needs to be enabled. Exploitation is bounded to Oracle Demand Planning versions 12.1 and 12.2 specifically. The primary limiting factor is network topology: if the application is not internet-facing and is segmented behind internal firewalls accessible only from trusted corporate networks, real-world exposure is substantially reduced. No user interaction or social engineering component is required to achieve exploitation.

The CVSS 3.1 score of 8.2 accurately reflects the attack profile: unauthenticated, network-accessible, low-complexity, with high confidentiality impact and bounded but real integrity impact. No EPSS score was included in the supplied intelligence, which limits probabilistic forecasting; however, the combination of AV:N, AC:L, PR:N, and UI:N represents near-worst-case exploitability conditions, and organizations should not rely on the absence of an EPSS figure as a risk-reduction signal. No CISA KEV listing is present, so active exploitation in the wild is not confirmed at this time, and no public proof-of-concept has been identified. Even a mid-sized municipal IT team in gdynia running Oracle E-Business Suite should treat this as urgent if Demand Planning endpoints are reachable from untrusted networks, as the authentication bypass requires no preconditions beyond HTTP access. The integrity impact (I:L), while lower on the CVSS scale, carries real operational consequence in a supply chain context - unauthorized modification of planning data can silently corrupt demand forecasts and procurement decisions. The absence of a CWE assignment slightly reduces root-cause confidence, but the authentication bypass tag sourced from Oracle's own security team (secalert_us@oracle.com) and the PR:N CVSS metric are mutually corroborating.

An unauthenticated attacker with HTTP network access to an Oracle Demand Planning deployment sends crafted requests directly to the Internal Operations component, bypassing its authentication controls without presenting credentials. The attacker retrieves the full dataset accessible to the application - including sensitive demand forecasts, supply chain figures, and planning records - and may also insert or alter limited subsets of that data. No public proof-of-concept code has been identified at the time of analysis, but the low attack complexity means exploitation could be scripted rapidly once the bypass mechanism is understood.