CVE-2026-70846: Oracle Demand Planning Auth Bypass Flaw

CVE-2026-70846 Overview

CVE-2026-70846 is a vulnerability in the Oracle Demand Planning product within Oracle Supply Chain, affecting the Internal Operations component. The flaw exists in supported versions 12.1 and 12.2. A low-privileged attacker with network access via HTTP can exploit the issue without user interaction. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, and complete read access to all Oracle Demand Planning accessible data. The vulnerability carries a scope change, meaning exploitation can impact resources beyond the vulnerable component.

Critical Impact
Network-exploitable flaw allowing a low-privileged attacker to compromise confidentiality and integrity of Oracle Demand Planning data, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Demand Planning version 12.1
Oracle Demand Planning version 12.2
Oracle Supply Chain — Internal Operations component

Discovery Timeline

2026-08-18 - CVE-2026-70846 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70846

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Demand Planning, part of the Oracle Supply Chain product family. Oracle's advisory classifies the issue as easily exploitable over HTTP with only low privileges required. The scope change indicated in the CVSS vector signals that a successful attack breaks the trust boundary of the vulnerable component. Attackers can pivot from Demand Planning to affect adjacent products or subsystems that trust it.

Impact on data is described as complete for both confidentiality and integrity. Attackers can read, modify, create, or delete any data accessible to Oracle Demand Planning. Availability is not directly impacted according to the advisory.

Root Cause

Oracle has not published the underlying weakness class or CWE mapping for this issue. The Oracle Critical Patch Update advisory references the Internal Operations component but does not disclose the specific defect. Based on the exploitation profile — network vector, low complexity, low privileges, no user interaction, and scope change — the flaw is consistent with an authorization or input validation defect exposed through an HTTP-accessible interface.

Attack Vector

Exploitation requires HTTP network access to the Oracle Demand Planning application and a low-privilege authenticated session. No user interaction is required. Because attack complexity is low, an authenticated attacker can reach the vulnerable code path through routine HTTP requests to the Internal Operations component. Refer to the Oracle Security Alert for vendor-provided technical detail.

No public proof-of-concept, exploit code, or CISA KEV listing is currently available for CVE-2026-70846. The EPSS probability is 0.365%.

Detection Methods for CVE-2026-70846

Indicators of Compromise

Unexpected HTTP requests to Oracle Demand Planning Internal Operations endpoints originating from low-privileged user accounts.
Unauthorized creation, modification, or deletion events in Demand Planning data stores that do not correlate with legitimate business workflows.
Cross-product data access anomalies indicating a scope-change exploitation attempt from Demand Planning to adjacent Oracle Supply Chain modules.

Detection Strategies

Baseline normal HTTP request patterns for the Demand Planning Internal Operations component and alert on deviations.
Correlate application-layer audit logs with database change logs to surface unauthorized data modification tied to Demand Planning sessions.
Monitor authenticated sessions using low-privilege roles for privilege-boundary crossings or access to resources outside their normal scope.

Monitoring Recommendations

Forward Oracle E-Business Suite and Demand Planning audit logs to a centralized SIEM or data lake for cross-source correlation.
Enable database-level auditing on tables accessed by Demand Planning to capture unauthorized read and write activity.
Alert on administrative or bulk data operations executed by non-administrative user accounts.

How to Mitigate CVE-2026-70846

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert for August 2026 to all Oracle Demand Planning 12.1 and 12.2 deployments.
Inventory all Oracle Supply Chain environments to confirm which instances run affected Demand Planning versions.
Restrict HTTP network access to Demand Planning to trusted internal networks and required user populations only.
Review and reduce the number of accounts with any level of Demand Planning access to shrink the exploitable user base.

Patch Information

Oracle addresses CVE-2026-70846 in the August 2026 Critical Patch Update. Administrators should download and apply the patches listed in the Oracle Security Alert for their specific Demand Planning version. Test the patch in a non-production environment before rolling it into production.

Workarounds

Place Oracle Demand Planning behind a web application firewall or reverse proxy that restricts access to the Internal Operations component.
Enforce network segmentation so only authorized application servers and administrative hosts can reach Demand Planning over HTTP.
Enable strict session monitoring and revoke stale or unused low-privilege accounts until patching is complete.

bash

# Configuration example
# Restrict access to Oracle Demand Planning Internal Operations endpoints
# at the reverse proxy layer until the Oracle CPU patch is applied.

location /OA_HTML/DemandPlanning/ {
    allow 10.0.0.0/8;        # trusted internal network
    deny  all;
    proxy_pass http://demandplanning-backend;
}