This vulnerability affects Oracle Demand Planning (component: Internal Operations) in versions 12.1 and 12.2. It is easily exploitable by unauthenticated attackers over the network via HTTP. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Demand Planning, as well as unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's advisory for the August 2026 Critical Security Patch Update references this vulnerability but does not specify a patch or remediation level for it yet.

An attacker can gain unauthorized access to critical and potentially all accessible data within Oracle Demand Planning and can perform unauthorized modifications to some data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable without authentication and requires only network access via HTTP.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay once available. Until a patch is confirmed, organizations should consider restricting network access to Oracle Demand Planning interfaces and monitor for unusual activity related to this product.