{"id":"CVE-2026-101547","kind":"vulnerability","aliases":["CVE-2026-101547"],"related":[],"title":"Oracle Demand Planning: unauthenticated HTTP flaw lets attackers read and change data","description":"Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations).  Supported versions that are affected are 12.1 and  12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demand Planning.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Demand Planning accessible data as well as  unauthorized read access to a subset of Oracle Demand Planning accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","summary":"Oracle Demand Planning versions 12.1 and 12.2 have a flaw in the Internal Operations component that can be reached over HTTP without a login. A successful attack, after a user takes one action, can read and modify some data the product stores, and can affect other products.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","oracle-demand-planning","self-hosted","supply-chain-software","vendor"],"not_affected_if":["not-on-supported-versions","product-not-installed"],"how_to_check":"- Confirm the installed Oracle Demand Planning release, which the sources do not specify beyond 12.1 and 12.2\n- Check the Oracle Critical Patch Update advisory for the patch level covering this CVE: unknown","fix":"- Apply the Oracle security patch for Demand Planning 12.1 and 12.2 listed in the Oracle advisory for CVE-2026-101547: unknown exact patch name\n- Restrict HTTP access to the Demand Planning Internal Operations interface to trusted networks until patched","status":"open","published_at":"2026-10-20T22:18:04+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:03:52+00:00","updated_at":"2026-10-25T04:03:52+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:03:52Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle security patch for Demand Planning 12.1 and 12.2 listed in the Oracle advisory for CVE-2026-101547: unknown exact patch name\n- Restrict HTTP access to the Demand Planning Internal Operations interface to trusted networks until patched","reach":"internet","title":"Oracle Demand Planning: unauthenticated HTTP flaw lets attackers read and change data","impact":"medium","summary":"Oracle Demand Planning versions 12.1 and 12.2 have a flaw in the Internal Operations component that can be reached over HTTP without a login. A successful attack, after a user takes one action, can read and modify some data the product stores, and can affect other products.","category":"vendor","nicknames":[],"who_cares":["oracle","oracle-demand-planning","supply-chain-software","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads and alters some Demand Planning data and affects other products","analyst_note":"Find the Oracle advisory and patch identifiers for Demand Planning 12.1 and 12.2 and confirm whether Internal Operations is exposed by default; source is NVD only.","how_to_check":"- Confirm the installed Oracle Demand Planning release, which the sources do not specify beyond 12.1 and 12.2\n- Check the Oracle Critical Patch Update advisory for the patch level covering this CVE: unknown","needs_analyst":true,"not_affected_if":["product-not-installed","not-on-supported-versions"],"who_is_affected":"Organizations running Oracle Demand Planning 12.1 or 12.2 with the Internal Operations component reachable over the network. Sites where the product is not deployed, or where it is only reachable from isolated internal networks, can deprioritize it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":3554,"output_tokens":659,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101547':15A,18A '-2026':14A,17A '/av':197C '12.1':36B,99C '12.2':38B,101C '3.1':185C,196C '6.1':188C 'access':110C,160C,167C,174C,182C 'action':64B 'addit':143C 'affect':76B,97C 'allow':105C 'attack':8A,58B,107C,119C,129C,139C,148C 'base':186C 'c/c':202C 'chain':29B,89C 'chang':11A,146C 'compon':46B,90C 'compromis':114C 'confidenti':189C 'cve':13A,16A 'cvss':184C,193C,195C 'data':12A,70B,168C,183C 'delet':159C 'demand':2A,22B,33B,83C,116C,137C,165C,180C 'easili':102C 'exploit':103C 'flaw':6A,41B 'host':26B 'http':5A,52B,112C 'human':121C 'impact':142C,192C 'insert':157C 'integr':191C 'interact':122C 'intern':44B,91C 'l/a':204C 'l/i':203C 'l/pr':199C 'let':7A 'login':55B 'may':140C 'modifi':68B 'n':205C 'n/ac':198C 'n/ui':200C 'network':109C 'one':63B 'oper':45B,92C 'oracl':1A,19B,21B,32B,82C,87C,115C,136C,164C,179C 'oracle-demand-plan':20B 'person':125C 'plan':3A,23B,34B,84C,117C,138C,166C,181C 'product':72B,78B,85C,144C 'r/s':201C 'reach':50B 'read':9A,66B,173C 'requir':120C 'result':153C 'scope':145C 'score':187C 'self':25B 'self-host':24B 'signific':141C 'softwar':30B 'store':73B 'subset':177C 'success':57B,118C,147C 'suppli':28B,88C 'supply-chain-softwar':27B 'support':93C 'take':62B 'unauthent':4A,106C 'unauthor':155C,172C 'updat':156C 'user':61B 'vector':194C 'vendor':31B 'version':35B,94C 'via':111C 'vulner':79C,104C,133C,151C 'well':170C 'without':53B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Demand Planning 12.1 or 12.2 with the Internal Operations component reachable over the network. Sites where the product is not deployed, or where it is only reachable from isolated internal networks, can deprioritize it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101547","severity":null,"published_at":"2026-10-20T22:18:04+00:00","modified_at":"2026-10-21T14:29:49+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}