EUVD-2026-61797
GHSA-99wx-55fv-788v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network HTTP reachable (AV:N) with low complexity and a low-privilege account (PR:L), no interaction; changed scope with high confidentiality/integrity but no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Planning. While the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demand Planning accessible data as well as unauthorized access to critical data or complete access to all Oracle Demand Planning accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Privilege-leveraging compromise of Oracle Demand Planning (Internal Operations component) in Oracle Supply Chain / E-Business Suite versions 12.1 and 12.2 lets a low-privileged attacker with HTTP network access read and modify all data reachable by the module. Because the CVSS scope is Changed (S:C), successful attacks can extend impact beyond Demand Planning to additional connected products. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network HTTP access to the Oracle Demand Planning Internal Operations component and a low-privileged authenticated account (CVSS PR:L), with no user interaction (UI:N) and low complexity (AC:L); it applies to Demand Planning 12.1 and 12.2. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, yielding high confidentiality and integrity impact with a cross-product scope change - a genuinely severe combination that justifies the 9.6 rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix delivered in Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html) to Oracle Demand Planning 12.1 and 12.2; the input does not name an exact patched build number, so treat the CPU bundle as the patch source and confirm the specific EBS patch ID for your release from that advisory (patch available per vendor advisory - released patched version not independently confirmed here). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Oracle Supply Chain Management or E-Business Suite versions 12.1 and 12.2, and immediately restrict HTTP network access to the Demand Planning module to essential users and systems only via firewall or network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Demand Planning
View allUnspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 12.1 and 12.2 al
Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attacke
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today