This vulnerability affects Oracle Demand Planning (component: Internal Operations) in versions 12.1 and 12.2. It is easily exploitable by an unauthenticated attacker over the network via HTTP. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Demand Planning, as well as unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with low integrity impact and no availability impact. Oracle's advisory references a Critical Security Patch Update released in August 2026, which includes many patches across products, but the specific patch availability for this vulnerability is not explicitly stated in the provided data.

An unauthenticated attacker with network access can exploit this vulnerability to gain unauthorized access to sensitive and critical data within Oracle Demand Planning. The attacker can also perform unauthorized data modifications, including updates, inserts, and deletions on some accessible data. This compromises confidentiality and integrity of the affected system's data, potentially leading to data breaches or data corruption.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update process. However, the provided advisory content does not explicitly confirm the availability of a patch specifically for CVE-2026-70852. Therefore, users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until a patch is applied, restrict network access to Oracle Demand Planning services where possible to mitigate exposure.