This vulnerability affects Oracle iStore versions 12.2.3 through 12.2.15 and allows unauthenticated network attackers to perform unauthorized data modifications and partial data disclosure via HTTP. Exploitation requires user interaction from a third party. The vulnerability impacts confidentiality and integrity but not availability, with a CVSS 3.1 score of 6.1. The scope of impact extends beyond Oracle iStore to other Oracle products. Oracle has published a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including this one, but the specific patch status for this vulnerability is not explicitly stated in the advisory content provided.

Successful exploitation can result in unauthorized update, insert, or delete access to some Oracle iStore accessible data, as well as unauthorized read access to a subset of that data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products may also be affected indirectly.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance and patch availability. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Since exploitation requires user interaction, user awareness and caution with unsolicited interactions may reduce risk until patches are applied.