CVE-2026-62516

HighCVSS 8.8

Published: 21/07/2026(UTC)Updated: 07/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Oracle Demantra Demand Management (part of Oracle Supply Chain) versions 12.2.3-12.2.15 have an easily exploitable vulnerability allowing a low-privileged attacker with network access via SQL to take over the product. CVSS 8.8.

Risk Assessment

Takeover of Oracle Demantra Demand Management can lead to full compromise of the supply chain management system, including confidentiality, integrity, and availability of data.

Recommendation

Apply the Oracle patch for Oracle Demantra Demand Management for versions 12.2.3-12.2.15.

Other vulnerabilities in Oracle Demantra Demand Management

CVE-2026-61041Critical
Vulnerability in Oracle Demantra Demand Management (component: Product Security) versions 12.2.3-12.2.15. An authenticated low-privileged attacker can take over the system via HTTP, with potential impact on other products (scope change).

Original NVD description (English source)

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Demantra Demand Management. Successful attacks of this vulnerability can result in takeover of Oracle Demantra Demand Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).