Oracle iStore CVE-2026-60815

Exploitation requires that a person other than the attacker - a user with a browser accessing Oracle iStore - actively interacts with attacker-controlled content, such as clicking a crafted HTTP link (UI:R per CVSS vector). The attacker requires no authentication credentials or prior account access (PR:N per CVSS vector). The vulnerable component is specifically the Shopping Cart within Oracle iStore; the target system must be running Oracle E-Business Suite version 12.2.3 through 12.2.15 with the iStore module and Shopping Cart feature deployed and network-accessible over HTTP. No special non-default configuration is described as required - any iStore installation in the affected version range with the Shopping Cart reachable over the network is potentially vulnerable. Exploitation is bounded by the victim's session scope: unauthorized access is limited to data accessible through the victim's iStore context, and availability is not impacted (A:N). The social-engineering dependency (UI:R) is the primary factor limiting opportunistic mass exploitation.

The CVSS 3.1 base score of 6.1 (Medium) accurately reflects a network-reachable, low-complexity attack with no authentication barrier but a mandatory victim-interaction step that limits opportunistic mass exploitation. The scope change (S:C) is the most significant risk amplifier - exploitation does not remain isolated within iStore but can propagate to adjacent EBS components in the same browser session, meaning the effective blast radius exceeds what the C:L/I:L metrics suggest in isolation. No EPSS score was provided in the intelligence data, so automated exploitation probability cannot be quantified. No CISA KEV listing and no public exploit code have been identified, indicating this is not currently under broad active exploitation. The vendor-supplied 'Authentication Bypass' tag introduces some ambiguity: if this label refers to a mechanism that neutralizes EBS authentication controls for adjacent modules, the real-world impact could be materially higher than a vanilla C:L/I:L XSS. Organizations running internet-facing iStore deployments with the Shopping Cart component exposed should treat this as a patch-cycle priority; air-gapped or intranet-only EBS deployments face reduced exposure due to the social-engineering requirement for victim click-through.

An attacker crafts a malicious URL targeting the Oracle iStore Shopping Cart component and delivers it to an EBS user via a phishing email or embedded link on a third-party site. When the victim clicks the link and their browser processes the Oracle iStore response, attacker-controlled script executes in the user's browser session, enabling unauthorized reading or modification of iStore-accessible data. Due to the confirmed scope change, the injected payload may also interact with adjacent Oracle E-Business Suite modules that share the same authenticated session, extending impact beyond the iStore application boundary.