What is the CVSS score of CVE-2026-60815?

CVE-2026-60815 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle iStore CVE-2026-60815

EUVD-2026-47123 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8x79-gv29-9x46

Authentication Bypass Oracle Istore

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Vendor-supplied vector is fully consistent with the description: network-reachable, no authentication, mandatory user interaction, low C/I impact on iStore data, scope change to adjacent EBS components, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:47 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iStore accessible data as well as unauthorized read access to a subset of Oracle iStore accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Cross-site injection in Oracle iStore's Shopping Cart component (E-Business Suite versions 12.2.3-12.2.15) enables unauthenticated remote attackers to read a subset of iStore-accessible data and perform unauthorized data modifications, with a scope change indicating impact can extend to adjacent Oracle E-Business Suite modules. The attack requires victim interaction via HTTP but no credentials, and Oracle has published a fix in the July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the vendor-assigned tag of 'Authentication Bypass' suggests the client-side injection may circumvent session-level controls beyond what the CVSS score alone implies.

Technical ContextAI

Oracle iStore is the customer-facing e-commerce storefront module within Oracle E-Business Suite (EBS), an enterprise ERP platform widely deployed in large organizations and government entities. The affected component is the Shopping Cart, which processes user-supplied input within a web-based retail workflow over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - network-accessible, no privileges, user interaction required, with scope change - is the canonical fingerprint of a reflected or stored cross-site scripting (XSS) class vulnerability, or a similar client-side injection weakness. The CWE classification is listed as N/A, which limits precise root-cause categorization. The 'Authentication Bypass' tag from Oracle's reporting team (secalert_us@oracle.com) may indicate that the injected payload can circumvent session-authentication checks within the browser context. Affected versions span Oracle EBS 12.2 branch, releases 12.2.3 through 12.2.15 inclusive.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html. The advisory confirms patch availability for the affected version range (12.2.3-12.2.15); the exact patched version number is not independently confirmed beyond the advisory and should be verified via Oracle My Oracle Support prior to deployment. As a compensating control while patching is scheduled, organizations can restrict external network access to the Oracle iStore Shopping Cart endpoint at the perimeter firewall or load balancer - note this degrades customer storefront functionality and is only viable for intranet or B2B deployments. Deploying a web application firewall rule to block or sanitize reflected input in Shopping Cart HTTP parameters can reduce client-side injection exposure without service interruption, though WAF rules are not a substitute for patching. Enforcing strict Content Security Policy headers via a reverse proxy can limit the execution scope of any injected script payloads, reducing the scope-change risk to adjacent EBS components.