Executive brief
Oracle Demand Signal Repository is a component of Oracle E-Business Suite used for supply chain planning and demand forecasting. A vulnerability in this component allows a low-privileged user with network access to gain complete control over the system, potentially compromising confidential business data, disrupting critical supply chain operations, and enabling unauthorized system modifications.
Technical details
The vulnerability is an easily exploitable flaw in Oracle Demand Signal Repository (versions 12.2.3 through 12.2.15) that requires low privilege access and network reachability via HTTP. An attacker with existing low-privilege credentials can exploit this to achieve full system compromise, including unauthorized access to sensitive data and the ability to modify or disrupt operations. The attack requires no complex preconditions (low complexity, no user interaction needed) and impacts all three security pillars: confidentiality, integrity, and availability. Patches are expected to be available through Oracle's standard security update channels.
Affected products
- Oracle Demand Signal Repository 12.2.3-12.2.15
Timeline
- 2026-09-15: disclosed