This vulnerability affects Oracle iStore versions 12.2.3 to 12.2.15 and permits a low-privileged attacker with network access over HTTP to compromise the system. Exploitation requires user interaction from someone other than the attacker and can result in unauthorized creation, deletion, or modification of critical data within Oracle iStore. The vulnerability also has scope change implications, potentially affecting additional Oracle products accessible via iStore. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope change, and high confidentiality and integrity impacts.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle iStore, as well as unauthorized access to all data accessible through Oracle iStore. The vulnerability also has scope change implications, meaning it may affect additional Oracle products beyond iStore. This can significantly compromise data integrity and confidentiality in affected environments.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches for Oracle iStore versions 12.2.3 through 12.2.15 without delay. Oracle recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks. Patch availability and installation instructions are provided in the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.