EUVD-2026-61803
GHSA-xwff-m7v8-57jx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-accessible HTTP endpoint with no authentication barrier per description and PR:N vector; high confidentiality and low integrity impacts confirmed; no availability impact stated or inferable.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demand Planning. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Demand Planning accessible data as well as unauthorized update, insert or delete access to some of Oracle Demand Planning accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
AnalysisAI
Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attackers over HTTP to read all data accessible to the application and perform limited unauthorized write operations, with no authentication, elevated privileges, or user interaction required. Tagged as an authentication bypass by Oracle's own security team, this flaw carries a CVSS 3.1 base score of 8.2, reflecting high confidentiality and low integrity impact with no availability component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required beyond network reachability of the Oracle Demand Planning Internal Operations component over HTTP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 accurately reflects the attack profile: unauthenticated, network-accessible, low-complexity, with high confidentiality impact and bounded but real integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Patch Update for August 2026, documented at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Oracle Demand Planning versions 12.1 and 12.2 instances across production and non-production environments; restrict network access to these systems to authorized internal networks only using firewall rules; and enable detailed transaction logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Demand Planning
View allPrivilege-leveraging compromise of Oracle Demand Planning (Internal Operations component) in Oracle Supply Chain / E-Bus
Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 12.1 and 12.2 al
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today