This vulnerability affects the Oracle iStore component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to gain unauthorized access, including creation, deletion, or modification of critical or all accessible data within Oracle iStore. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no required user interaction. The vulnerability is classified under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory mentions multiple security patches but does not explicitly state a patch for this vulnerability, leaving remediation status unconfirmed.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle iStore. It also allows unauthorized access to critical data or complete access to all Oracle iStore accessible data, impacting confidentiality and integrity. There is no impact on availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly and remaining on actively-supported versions to mitigate exploitation risks. Until a specific patch is confirmed, restrict network access to Oracle iStore and monitor for unusual activity consistent with unauthorized data access or modification.