This vulnerability affects Oracle Retail Xstore Point of Service (component: Xstore Mobile) version 21.0.3. An attacker with low privileges and logon access to the infrastructure can exploit this flaw to compromise the product and obtain unauthorized read access to a subset of data accessible by the application. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact. No official patch or remediation level is currently specified in the vendor advisory. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation results in unauthorized read access to some data within Oracle Retail Xstore Point of Service. There is no impact on data integrity or availability. The confidentiality impact is limited, and the overall severity is low.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle recommends applying security patches promptly when available. Until a patch is confirmed, restrict logon access to the infrastructure hosting Oracle Retail Xstore Point of Service to trusted users only.