This vulnerability affects Oracle Demantra Demand Management within Oracle Supply Chain, specifically versions 12.2.3 to 12.2.15. It is exploitable remotely over the network by an attacker with low privileges via SQL injection or similar SQL-based attack vectors. Successful exploitation can lead to complete compromise of the Oracle Demantra Demand Management system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not provide explicit patch availability details for it in the provided excerpt.

The vulnerability allows an attacker with low privileges and network access to fully compromise Oracle Demantra Demand Management, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, and denial of service within the affected product.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Patch status for this specific vulnerability is not explicitly confirmed in the provided advisory excerpt; therefore, users should verify patch availability and installation instructions from the official Oracle advisory. Maintaining up-to-date patched versions is critical to mitigate this vulnerability.