This vulnerability in Oracle Retail Xstore Point of Service (component: Xstore Mobile) version 21.0.3 allows a low privileged attacker with network access over HTTP to compromise the system resulting in unauthorized read access to a subset of accessible data. The CVSS 3.1 base score is 4.3, reflecting a confidentiality impact with no integrity or availability impact. The attack complexity is low, requiring no user interaction, and the attacker must have low privileges. Oracle has published a Critical Patch Update advisory covering multiple vulnerabilities but does not explicitly confirm a patch or remediation for this specific issue in the provided advisory content.

Successful exploitation results in unauthorized read access to some data within Oracle Retail Xstore Point of Service 21.0.3. The impact is limited to confidentiality with no reported effects on data integrity or system availability. The vulnerability requires network access via HTTP and low privilege on the system, making it moderately accessible to attackers with some access.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends customers remain on actively-supported versions and apply security patches promptly. Until a specific patch is released and applied, limit network access to the affected service and monitor for unusual activity related to Oracle Retail Xstore Point of Service.