Oracle Demand Planning CVE-2026-83394

Exploitation requires the attacker to hold a valid low-privileged Oracle Demand Planning account (PR:L) on version 12.1 or 12.2, reachable over the network via HTTP. It additionally requires successful human interaction from a victim other than the attacker (UI:R) - e.g. a targeted user following a crafted link or viewing attacker-influenced content - so it cannot be triggered autonomously. Limiting factors: the need for authentication, the mandatory second-party user interaction, and confidentiality-only impact (no integrity or availability effect) significantly narrow realistic exploitation to social-engineering-assisted data disclosure against logged-in users; the scope change (S:C) means successful attacks may expose data in additional Oracle products beyond Demand Planning.

This is a moderate-priority issue, not a top-tier emergency. The vendor-assigned CVSS 3.1 score of 6.8 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) reflects a network-reachable but constrained flaw: it requires an authenticated low-privileged account (PR:L) AND human interaction from a victim other than the attacker (UI:R), which materially lowers real-world exploitability versus an unauthenticated drive-by bug. Impact is confidentiality-only (C:H, I:N, A:N) with a scope change (S:C), meaning data exposure can extend beyond Oracle Demand Planning into additional products. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of required authentication plus required user interaction, with no integrity or availability impact, places this below critical Oracle CPU items. Note a conflict in the input metadata: the 'Authentication Bypass' tag contradicts the CVSS vector (PR:L requires a valid low-privileged session) and the description (unauthorized data access via tricked user interaction, not a bypass of authentication) - treat the tag as suspect and verify against the Oracle October 2026 CPU advisory.

An attacker with a low-privileged Oracle Demand Planning account crafts a malicious HTTP request or link (the UI:R plus confidentiality-only, scope-changing profile is consistent with a stored/reflected cross-site scripting-style data-disclosure flaw) and lures a higher-context user into interacting with it. When the victim interacts, the attacker gains unauthorized read access to critical data, potentially spanning additional Oracle products due to the scope change. No public exploit code was provided in the input.