---
id: "CVE-2026-101547"
kind: "vulnerability"
aliases: ["CVE-2026-101547"]
title: "Oracle Demand Planning: unauthenticated HTTP flaw lets attackers read and change data"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle", "oracle-demand-planning", "self-hosted", "supply-chain-software", "vendor"]
not_affected_if: ["not-on-supported-versions", "product-not-installed"]
published_at: "2026-10-20T22:18:04+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:03:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101547", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Demand Planning: unauthenticated HTTP flaw lets attackers read and change data

Oracle Demand Planning versions 12.1 and 12.2 have a flaw in the Internal Operations component that can be reached over HTTP without a login. A successful attack, after a user takes one action, can read and modify some data the product stores, and can affect other products.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed Oracle Demand Planning release, which the sources do not specify beyond 12.1 and 12.2
- Check the Oracle Critical Patch Update advisory for the patch level covering this CVE: unknown

## Fix

- Apply the Oracle security patch for Demand Planning 12.1 and 12.2 listed in the Oracle advisory for CVE-2026-101547: unknown exact patch name
- Restrict HTTP access to the Demand Planning Internal Operations interface to trusted networks until patched

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101547

## From the sources

Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations).  Supported versions that are affected are 12.1 and  12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demand Planning.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Demand Planning accessible data as well as  unauthorized read access to a subset of Oracle Demand Planning accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_