CVE-2026-83394
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in the Internal Operations component of Oracle Demand Planning (Oracle Supply Chain) in versions 12.1 and 12.2. A low-privileged attacker with HTTP network access can gain unauthorized access to critical data, requiring user interaction and potentially impacting additional products.
Risk Assessment
A low-privileged attacker, after inducing user interaction, can access critical Oracle Demand Planning data. This may lead to leakage of confidential business information.
Recommendation
Apply Oracle's fix for Oracle Demand Planning 12.1 and 12.2. Restrict account privileges and educate users about phishing and unsafe interactions.
Other vulnerabilities in Oracle Demand Planning
See all- CVE-2026-101547Medium
Vulnerability in Oracle Demand Planning (Internal Operations component) affecting versions 12.1 and 12.2. An unauthenticated attacker with network access via HTTP can exploit it, but human interaction is required; attacks may significantly impact additional products (scope change). Successful attacks can result in unauthorized update, insert or delete access to some data and unauthorized read access to a subset of data.
- CVE-2026-70846Critical
Vulnerability in Oracle Demand Planning (Oracle Supply Chain), component Internal Operations. Affected versions are 12.1 and 12.2. A low privileged attacker can remotely access and modify data via HTTP, with impact on other products.
- CVE-2016-3527Critical
Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 12.1 and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to ODPDA Servlet.
- CVE-2026-70852High
Vulnerability in Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Affects versions 12.1 and 12.2. An unauthenticated attacker with network access via HTTP can easily compromise the system. Successful attacks may result in unauthorized access to critical data or complete access to all Oracle Demand Planning data, as well as unauthorized update, insert, or delete access to some data.
Original NVD description (English source)
Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Planning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Demand Planning accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS