A vulnerability exists in the Oracle iStore product of Oracle E-Business Suite, specifically in the Shopping Cart component. It affects supported versions from 12.2.3 through 12.2.15. The flaw allows a low-privileged attacker with network access via HTTP to compromise the system, potentially resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with significant confidentiality and integrity impacts. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected versions.