What is the CVSS score of EUVD-2026-47122?

EUVD-2026-47122 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle iStore are affected by EUVD-2026-47122?

Oracle iStore, the customer-facing storefront component of Oracle E-Business Suite, can be completely compromised by high-privileged attackers, threatening customer data confidentiality, transaction…

How to fix or mitigate EUVD-2026-47122?

Within 24 hours, conduct a comprehensive audit of all Oracle iStore deployments to identify any systems running versions 12.2.3 through 12.2.15 across production and non-production environments. Within 7 days, apply the July 2026 Critical Patch Update for Oracle E-Business Suite to all affected iStore instances, prioritizing production systems. Within 30 days, verify complete patch deployment across the organization and implement enhanced monitoring and logging for the Shopping Cart component to detect any suspicious access patterns.

Oracle iStore EUVD-2026-47122

| CVE-2026-60813 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-pv55-6283-9pqh

Authentication Bypass Oracle Istore

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP access with low complexity but requires a pre-existing high-privileged iStore account (PR:H), and takeover yields full confidentiality, integrity, and availability impact within the unchanged component scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:57 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in takeover of Oracle iStore. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle iStore (the Oracle E-Business Suite customer-facing web storefront) is possible via its Shopping Cart component in releases 12.2.3 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and shipped a fix in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle iStore is the e-commerce/self-service storefront module of Oracle E-Business Suite (EBS), Oracle's on-premise ERP suite, and the flaw resides in its Shopping Cart component reachable over HTTP. Oracle did not assign a CWE (CWE: N/A) and does not disclose the specific defect class in its CPU advisory, so the exact root cause (e.g. injection, access-control bypass, or deserialization) cannot be confirmed from the available data. The CVSS vector (S:U, full C/I/A high) indicates the vulnerability is contained within the iStore application component itself but grants complete control over that component once triggered. Oracle's own tag of 'Information Disclosure' is narrower than the description's stated 'takeover' outcome and the full C:H/I:H/A:H impact, so treat the tag as incomplete rather than authoritative.

RemediationAI

Vendor-released patch: apply the fixes delivered in the Oracle Critical Patch Update of July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html, which is the primary and recommended remediation for all affected 12.2.3-12.2.15 instances (Oracle CPUs are cumulative, so applying the current CPU addresses this CVE). Because exploitation requires a high-privileged account (PR:H), interim compensating controls until patching should focus on privilege and exposure reduction: audit and minimize the set of accounts holding elevated iStore/EBS privileges, and restrict network access to the iStore Shopping Cart endpoints so they are not reachable from untrusted networks or the public internet (trade-off: limiting external reachability may disrupt legitimate customer-facing storefront traffic and must be scoped to internal/administrative access paths). Increase monitoring of privileged-user activity on iStore as a detective control while the patch is scheduled.