CVE-2026-61041

CriticalCVSS 9.9

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

36th percentile - higher than 36% of all known CVEs

Summary

Vulnerability in Oracle Demantra Demand Management (component: Product Security) versions 12.2.3-12.2.15. An authenticated low-privileged attacker can take over the system via HTTP, with potential impact on other products (scope change).

Risk Assessment

Risk of takeover of the demand management system and potential impact on other Oracle supply chain systems, potentially leading to forecast manipulation and supply disruptions.

Recommendation

Apply the Oracle patch; restrict user privileges and monitor access to the Product Security component.

Original NVD description (English source)

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demantra Demand Management. While the vulnerability is in Oracle Demantra Demand Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Demantra Demand Management. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).