Threats affecting pkg:maven/com.oracle.ebusiness/istore

A vulnerability exists in the Oracle iStore product of Oracle E-Business Suite, specifically in the Shopping Cart component. It affects supported versions 12.2.3 through 12.2.15. The flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data within Oracle iStore. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with a significant confidentiality impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.