CVE-2026-60817
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iStore accessible data as well as unauthorized access to critical data or complete access to all Oracle iStore accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle iStore, a component of the Oracle E-Business Suite that handles online shopping cart functionality. The flaw is present in versions 12.2.3 through 12.2.15, representing a significant security gap in Oracle's e-commerce platform. The vulnerability is categorized as easily exploitable, meaning that attackers with minimal technical expertise can leverage it to compromise the system. This represents a critical risk for organizations relying on Oracle E-Business Suite for their commercial operations.
The technical nature of this vulnerability stems from insufficient access controls within the shopping cart component, allowing low privileged attackers with network access via HTTP to bypass normal authentication and authorization mechanisms. The CVSS 3.1 score of 8.1 indicates a high severity issue with significant impacts to both confidentiality and integrity. Attackers can potentially create, delete, or modify critical data within the iStore environment, as well as gain unauthorized access to all accessible data. The vulnerability's vector shows network accessibility with low attack complexity and requires only low privileges, making it particularly dangerous for organizations where network exposure is inevitable.
The operational impact of this vulnerability extends beyond simple data compromise. Successful exploitation can lead to complete data destruction or modification of critical business information stored within the Oracle iStore system. Organizations may face significant financial losses, regulatory compliance violations, and reputational damage if customer transaction data, pricing information, or inventory details are compromised. The low privilege requirement means that even casual attackers with basic network access could potentially cause substantial harm to enterprise operations.
Mitigation strategies should focus on immediate patching of affected Oracle E-Business Suite versions, implementing network segmentation to restrict access to iStore components, and establishing robust monitoring for unauthorized access attempts. Organizations should also consider implementing additional authentication controls and regularly reviewing access permissions within the system. The vulnerability aligns with CWE-284 (Improper Access Control) and may be related to ATT&CK techniques involving privilege escalation and data manipulation. Given the high CVSS score and the potential for complete data compromise, organizations must prioritize remediation efforts and consider conducting comprehensive security assessments of their Oracle E-Business Suite deployments to identify any additional vulnerabilities that might exist in similar components or related systems.