CVE-2026-70852: Oracle Demand Planning Auth Bypass Flaw

CVE-2026-70852 Overview

CVE-2026-70852 is a network-exploitable vulnerability in the Internal Operations component of Oracle Demand Planning, part of the Oracle Supply Chain product family. The flaw affects Oracle E-Business Suite versions 12.1 and 12.2. An unauthenticated attacker with HTTP access to the application can exploit the issue without user interaction. Successful exploitation grants read access to all data accessible to Oracle Demand Planning and permits limited unauthorized insert, update, or delete operations on a subset of that data.

Critical Impact
Unauthenticated remote attackers can exfiltrate sensitive supply chain planning data and tamper with a subset of records over HTTP.

Affected Products

Oracle Demand Planning version 12.1
Oracle Demand Planning version 12.2
Internal Operations component of Oracle Supply Chain

Discovery Timeline

2026-08-18 - CVE-2026-70852 published to NVD
2026-08-20 - Last updated in NVD database
August 2026 - Addressed in the Oracle Security Alert August 2026

Technical Details for CVE-2026-70852

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Demand Planning. An attacker reaches the affected code path over HTTP without authenticating or interacting with a user. The attack complexity is low, and exploitation does not require elevated privileges. The scope remains unchanged, so impact is confined to resources managed by the vulnerable Oracle Demand Planning instance.

Successful exploitation yields high confidentiality impact and limited integrity impact. Attackers can read all data reachable by the application and modify, insert, or delete some records. Availability is not affected, which suggests the flaw enables data-layer abuse rather than service disruption. Oracle has not published deeper technical detail beyond the advisory, consistent with its Critical Patch Update disclosure policy.

Root Cause

Oracle's advisory does not enumerate a specific weakness class. The impact profile of unauthenticated network access combined with broad read and partial write capability is characteristic of missing authentication or improper access control on an HTTP-exposed function within the Internal Operations component. No CWE identifier is currently associated with the record.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires reachability to the Oracle Demand Planning web tier but no credentials, tokens, or user interaction. Internet-exposed or partner-accessible Oracle E-Business Suite deployments carry the highest exposure. Environments where Oracle Demand Planning is restricted to internal management networks reduce, but do not eliminate, the risk from insider or lateral-movement scenarios.

No verified proof-of-concept code is publicly available. See the Oracle Security Alert August 2026 for vendor-supplied technical guidance.

Detection Methods for CVE-2026-70852

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Oracle Demand Planning Internal Operations endpoints originating from unexpected source addresses.
Anomalous read volumes against Demand Planning tables or views, particularly bulk exports outside normal batch windows.
Unexpected INSERT, UPDATE, or DELETE statements executed by Oracle Demand Planning application accounts against planning data.
Web tier access logs showing requests to Internal Operations URLs without a preceding authentication event.

Detection Strategies

Correlate Oracle E-Business Suite access logs with database audit trails to identify requests that reach Demand Planning data without an authenticated session.
Baseline typical Demand Planning request patterns and alert on deviations in URI paths, request rates, or source geolocation.
Enable Oracle Fine-Grained Auditing (FGA) on sensitive Demand Planning tables to capture read operations tied to the application service account.

Monitoring Recommendations

Forward Oracle E-Business Suite web tier, application, and database audit logs to a centralized analytics platform for cross-source correlation.
Alert on outbound data transfers from Oracle application servers that exceed historical norms.
Monitor for scanning activity against Oracle E-Business Suite HTTP endpoints from external networks.

How to Mitigate CVE-2026-70852

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert August 2026 to Oracle E-Business Suite 12.1 and 12.2 deployments.
Inventory all Oracle Demand Planning instances and confirm patch status against Oracle's advisory metadata.
Restrict network reachability to the Oracle E-Business Suite web tier so only trusted networks can send HTTP traffic to Internal Operations endpoints.
Review database audit logs for the past several months for anomalous Demand Planning activity predating the patch.

Patch Information

Oracle addressed CVE-2026-70852 in the August 2026 Security Alert cycle. Administrators should download the relevant patch for Oracle E-Business Suite 12.1 or 12.2 from My Oracle Support and follow the vendor-supplied README for prerequisites, downtime, and post-install validation. Oracle's advisory is the authoritative source for patch identifiers.

Workarounds

Place the Oracle E-Business Suite web tier behind a reverse proxy or web application firewall that enforces authentication and blocks unauthenticated access to Demand Planning URIs.
Segment Oracle Demand Planning application and database servers away from general corporate and internet-facing networks until the patch is applied.
Disable or restrict the Internal Operations component functionality where operationally feasible pending patch deployment.
Rotate credentials and audit privileges for Oracle Demand Planning service accounts after patching to invalidate any material exposed during the exposure window.