This vulnerability affects Oracle Demand Planning 12.1 and 12.2 and allows an attacker with low privileges and network access via HTTP to compromise the system. The attack can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all accessible data within Oracle Demand Planning. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts without affecting availability. Oracle's August 2026 Critical Security Patch Update advisory includes fixes for this vulnerability and strongly urges customers to apply patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Demand Planning, as well as unauthorized access to all data accessible by the product. The vulnerability has a critical severity with a CVSS score of 9.6, indicating significant confidentiality and integrity impacts. Additionally, the vulnerability's scope change means it may affect other Oracle products beyond Demand Planning.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the official patches promptly to mitigate the risk. No alternative mitigations or workarounds are indicated in the vendor advisory. Maintaining up-to-date patched versions is the recommended course of action.