Threat Intelligence Database

CVE-2026-70852 is a high-severity vulnerability in Oracle Demand Planning versions 12.1 and 12.2. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating significant confidentiality and integrity impacts. Oracle has published a Critical Security Patch Update advisory addressing multiple vulnerabilities but does not explicitly confirm the patch status for this specific issue in the provided content.

CVE-2026-70846 is a critical vulnerability in Oracle Demand Planning versions 12.1 and 12.2 that allows a low privileged attacker with network access via HTTP to compromise the product. Exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all data accessible by Oracle Demand Planning. The vulnerability has a CVSS 3.1 base score of 9.6, indicating high confidentiality and integrity impact with no availability impact. The vulnerability may also affect additional Oracle products due to scope change. Oracle has published a Critical Security Patch Update advisory for August 2026 addressing this and other vulnerabilities, recommending customers apply patches promptly.