This vulnerability affects Oracle Demantra Demand Management within Oracle Supply Chain, specifically versions 12.2.3 through 12.2.15. It is an easily exploitable flaw that permits a low privileged attacker with network access to leverage SQL-based attack vectors to compromise the system. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is associated with CWE-89 (SQL Injection) and CWE-284 (Improper Access Control). The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but references the July 2026 Critical Patch Update, which includes numerous fixes across Oracle products. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation of this vulnerability can result in complete takeover of Oracle Demantra Demand Management, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could allow attackers to access sensitive data, alter or delete information, and disrupt service operations.

Patch status is not yet confirmed for this specific vulnerability; check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions to mitigate risks. Until an official patch is confirmed and applied, restrict network access to Oracle Demantra Demand Management instances to trusted users only and monitor for suspicious SQL activity related to the product.