Demantra Demand Management
Monthly
Full takeover of Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) is possible when a low-privileged, network-authenticated attacker submits crafted SQL against the Product Security component, yielding complete loss of confidentiality, integrity, and availability. Oracle rates this 8.8 (CVSS 3.1) and addresses it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 'via SQL' wording combined with the tags points to a SQL-injection-class weakness in an authenticated interface.
Privilege escalation to full application takeover in Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) lets a low-privileged, authenticated attacker with HTTP network access compromise the Product Security component and, because of a scope change, significantly impact additional connected products. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top-tier patch priority.
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Security). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite (subcomponent: Product Security). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite (subcomponent: Product Security). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite (subcomponent: Product Security). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Full takeover of Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) is possible when a low-privileged, network-authenticated attacker submits crafted SQL against the Product Security component, yielding complete loss of confidentiality, integrity, and availability. Oracle rates this 8.8 (CVSS 3.1) and addresses it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 'via SQL' wording combined with the tags points to a SQL-injection-class weakness in an authenticated interface.
Privilege escalation to full application takeover in Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) lets a low-privileged, authenticated attacker with HTTP network access compromise the Product Security component and, because of a scope change, significantly impact additional connected products. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top-tier patch priority.
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Security). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite (subcomponent: Product Security). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite (subcomponent: Product Security). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite (subcomponent: Product Security). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.