CVE-2026-60815 in iStore
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iStore accessible data as well as unauthorized read access to a subset of Oracle iStore accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle iStore, a component of the Oracle E-Business Suite that handles shopping cart functionality for e-commerce operations. The affected versions span from 12.2.3 through 12.2.15, representing a significant release range that would impact numerous enterprise deployments. The vulnerability is classified as easily exploitable, meaning that attackers can leverage it with minimal technical sophistication and without requiring authentication credentials. The attack vector operates through HTTP network access, making it particularly dangerous as it can be executed from external networks without requiring insider knowledge or privileged access.
The technical flaw manifests in the shopping cart component's insufficient input validation and access control mechanisms, allowing unauthorized users to manipulate data within the iStore environment. While the vulnerability requires human interaction from an individual other than the attacker, this characteristic suggests a social engineering component where users might be induced to perform specific actions that trigger the exploit. The scope change aspect indicates that successful exploitation could extend beyond just iStore to impact additional Oracle products within the E-Business Suite ecosystem, potentially creating cascading security implications across the enterprise's financial and operational systems.
The operational impact of this vulnerability is substantial as it enables unauthorized modification of data through update, insert, or delete operations on sensitive iStore information. Additionally, attackers can gain read access to portions of data that should remain protected, compromising both data integrity and confidentiality. The CVSS 3.1 base score of 6.1 reflects the moderate severity level, with confidentiality and integrity impacts rated as low, though the combination of these factors creates meaningful risk for enterprise environments. The vector analysis (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network-based attack accessibility with low complexity, no privilege requirements, and user interaction as a necessary component while showing the scope change that affects additional products.
Organizations should implement immediate mitigations including network segmentation to limit access to iStore components, thorough review of access controls, and deployment of web application firewalls to monitor and filter HTTP traffic. Regular security assessments should validate that input validation mechanisms are properly configured and that user interaction points have appropriate safeguards against manipulation. The vulnerability aligns with CWE-20 (Improper Input Validation) and potentially CWE-352 (Cross-Site Request Forgery) categories, while attack patterns may map to ATT&CK techniques involving credential access through web application exploitation and data manipulation. Given the scope change potential, enterprise security teams must conduct comprehensive impact assessments across all Oracle E-Business Suite components to identify additional vulnerable areas that may require similar remediation efforts.