This vulnerability affects Oracle iStore versions 12.2.3 to 12.2.15 and involves improper access control (CWE-284) in the Shopping Cart component. A low privileged attacker with network access via HTTP could exploit this flaw to compromise Oracle iStore, resulting in unauthorized access to sensitive or critical data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No known exploits in the wild have been reported. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but recommends applying Critical Patch Updates promptly.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle iStore, compromising confidentiality. There is no impact on integrity or availability. The vulnerability requires network access and is difficult to exploit due to high attack complexity and low privileges required.

Oracle has not explicitly confirmed a patch for this specific vulnerability in the provided advisory but strongly recommends applying the latest Critical Patch Updates without delay. Customers should ensure they are running actively supported versions and apply all relevant security patches from Oracle's July 2026 Critical Patch Update. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.