Description

Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Planning. While the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demand Planning accessible data as well as unauthorized access to critical data or complete access to all Oracle Demand Planning accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-18T21:17:40.430Z",
  "pubdate": "2026-08-18T21:17:40.430Z",
  "executiveSummary": "A security vulnerability has been identified within the Internal Operations component of Oracle Demand Planning, specifically affecting versions 12.1 and 12.2. This vulnerability presents a severe risk to organizational data integrity and confidentiality due to its high CVSS 3.1 base score of 9.6. An attacker with low-level privileges can leverage this flaw remotely over the network using the HTTP protocol to execute unauthorized actions. The security defect involves a scope change, meaning that successful exploitation is not strictly contained within Oracle Demand Planning, but may also significantly impact additional integrated products within the Oracle Supply Chain ecosystem. The consequences of a successful exploit include unauthorized read, create, delete, and modification access to critical and sensitive data accessible by the application. Because the attack vector is network-based with low attack complexity and requires no user interaction, malicious actors can exploit the system efficiently once low-privileged credentials are acquired. Immediate administrative intervention and application of vendor-supplied patches are critical to mitigating the associated risks and preventing potential data compromise.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Demand Planning versions 12.1 and 12.2, exposing an attack surface accessible via HTTP network requests. Exploitation of this vulnerability requires a low-privileged authenticated user to initiate requests to the vulnerable application endpoint, meaning complete anonymous exploitation is theoretically restricted, but easily reachable by any user possessing basic access rights. The attack flow commences with the malicious actor leveraging standard HTTP communication protocols to interact with the vulnerable component. Due to inadequate input validation, improper access controls, or flawed authorization logic within the Internal Operations module, the attacker can bypass security boundaries. The inclusion of a scope change vector (S:C) in the CVSS metrics indicates that the security authority boundary is transcended, allowing the attacker to interact with resources outside the immediate administrative domain of Oracle Demand Planning, potentially compromising other co-hosted or integrated products in the Oracle Supply Chain environment. Upon successful transmission of the malicious payload, the execution flow allows unauthorized actors to perform operations violating the principle of least privilege. Specifically, the attacker achieves unauthorized read access to critical data (C:H) and unauthorized creation, deletion, or modification access to critical data (I:H), while availability remains unaffected (A:N). The root cause stems from insufficient enforcement of operational permissions and inadequate sanitization of requests processed by the Internal Operations component. Because the attack complexity is classified as low and user interaction is not required, an adversary can automate the exploitation process reliably once initial low-privileged access is established, leading to severe downstream security compromises across the targeted infrastructure."
}