Vulnerability in Oracle Demand Planning Affects Oracle Supply Chain
CVE-2026-70846

9.6CRITICAL

Key Information:

Vendor

Oracle
Status
Oracle Demand Planning
Vendor
CVE Published:
18 August 2026

What is CVE-2026-70846?

A vulnerability exists within Oracle Demand Planning, part of the Oracle Supply Chain suite, that can be exploited by low privileged attackers with network access through HTTP. This flaw allows unauthorized users to create, delete, or modify sensitive data, significantly compromising the integrity and confidentiality of the information within Oracle Demand Planning. The impact extends beyond Oracle Demand Planning itself, potentially affecting other connected products within the supply chain ecosystem.

Affected Version(s)

Oracle Demand Planning 12.1

Oracle Demand Planning 12.2

References

https://www.oracle.com/security-alerts/cspuaug2026.html
vendor-advisory

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.