CVE-2026-83134 is a vulnerability in the Oracle iStore product of Oracle E-Business Suite, affecting the Shopping Cart component in versions 12.2.3 to 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise Oracle iStore, resulting in unauthorized access to critical data. The vulnerability has a CVSS 3.1 score of 7.7, with network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data within Oracle iStore and potentially impact additional Oracle products due to scope change. The confidentiality of sensitive information is at high risk, although integrity and availability are not impacted according to the CVSS vector. The vulnerability is exploitable remotely over the network with low complexity and requires only low privileges, increasing the risk of compromise if unpatched.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should promptly apply the relevant patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15 to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No additional mitigation steps are indicated beyond patching.