This vulnerability in Oracle iStore versions 12.2.3 to 12.2.15 allows an attacker with low privileges and network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible via Oracle iStore. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory from Oracle references this vulnerability within the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation level for Oracle iStore in the provided excerpt.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible through Oracle iStore. This compromises the confidentiality and integrity of the affected system's data. Availability impact is not indicated. The vulnerability is exploitable remotely over HTTP by an attacker with low privileges, increasing the risk of compromise.

Oracle has published a Critical Patch Update advisory in July 2026 that includes multiple security patches. However, the provided advisory content does not explicitly confirm the availability of a patch or remediation for Oracle iStore for this specific vulnerability. Customers should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until explicit patch information is confirmed, organizations should prioritize patch verification and deployment as per Oracle guidance.