CVE-2026-60815 is a medium severity vulnerability in Oracle iStore versions 12.2.3 through 12.2.15 that allows an unauthenticated attacker with network access via HTTP to perform unauthorized data modification (update, insert, delete) and unauthorized read access on some Oracle iStore accessible data. Exploitation requires user interaction from a person other than the attacker, and the vulnerability's impact scope extends beyond Oracle iStore to additional Oracle products. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and low confidentiality and integrity impacts with no availability impact. The vendor advisory linked does not explicitly confirm a patch or remediation level for this specific vulnerability but strongly recommends applying available security patches generally.

Successful exploitation can result in unauthorized modification (update, insert, delete) and unauthorized read access to Oracle iStore data, impacting confidentiality and integrity. The vulnerability affects the security scope beyond Oracle iStore, potentially impacting additional Oracle products. There is no reported impact on availability. The attack requires user interaction from a third party and network access via HTTP.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. Since no explicit patch or workaround is stated for this vulnerability, monitoring the vendor advisory for updates is essential.