CVE-2026-101547

Awaiting Analysis Awaiting Analysis - Queue

Oracle Demand Planning Unauthorized Data Access Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-11-06

Assigner: Oracle

Description

Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demand Planning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Demand Planning accessible data as well as unauthorized read access to a subset of Oracle Demand Planning accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-06

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101547

EUVD

EUVD-2026-105958

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Demand Planning	12.1
Oracle Corporation	Oracle Demand Planning	12.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Demand Planning, part of Oracle Supply Chain. It affects versions 12.1 and 12.2. An unauthenticated attacker can exploit it remotely via HTTP to compromise the system. Exploitation requires human interaction from a victim and may impact other products. The flaw allows unauthorized data access and modifications.

Detection Guidance

This vulnerability affects Oracle Demand Planning versions 12.1 and 12.2. Detection requires checking for exposed HTTP interfaces and verifying software versions. Use commands like 'curl -I http://[target]' to check HTTP headers or 'nmap -p 80,443 [target]' to scan for open web ports. Confirm installed Oracle Demand Planning versions via system logs or application interfaces.

Impact Analysis

An attacker could read or alter some data in Oracle Demand Planning. This might lead to data breaches, incorrect planning data, or disruptions in supply chain operations. Human interaction is required, so phishing or tricking a user into triggering the exploit is necessary.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy). Organizations using affected Oracle Demand Planning versions may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle Demand Planning versions 12.1 and 12.2 to address the vulnerability. Ensure HTTP access is restricted to trusted networks and users. Monitor for unauthorized data access or modifications in Oracle Demand Planning.

Hi! I’m here to help you understand CVE-2026-101547. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...