This vulnerability in Oracle iStore (component: Shopping Cart) affects versions 12.2.3 to 12.2.15. It permits a high privileged attacker with network access over HTTP to compromise the Oracle iStore application, potentially resulting in complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others and provides cumulative patches. However, the vendor advisory does not explicitly state the patch availability status for Oracle iStore or specific remediation instructions for this CVE. Customers are strongly advised to apply the latest Critical Patch Update to mitigate this and other vulnerabilities.

Successful exploitation allows a high privileged attacker with network access via HTTP to fully compromise Oracle iStore, impacting confidentiality, integrity, and availability of the system. This could lead to complete takeover of the Oracle iStore application, potentially affecting business operations relying on this component.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple security vulnerabilities, including this one. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Since the advisory is cumulative, applying the latest patches is the recommended remediation. No specific temporary mitigations or workarounds are provided in the advisory. Patch status is not explicitly confirmed for Oracle iStore in the advisory; therefore, customers should verify patch applicability and installation instructions from Oracle's official resources.