Oracle iStore EUVD-2026-47124

Exploitation requires an active authenticated session with at least low-privileged access to Oracle iStore over HTTP - PR:L confirms some level of authentication is mandatory, ruling out unauthenticated remote exploitation. The AC:H metric indicates a non-trivial condition must be satisfied beyond simply being authenticated: this likely involves a specific request sequence, parameter combination, or race condition within the Shopping Cart component. The vulnerability does not affect integrity or availability (I:N, A:N), limiting impact strictly to data read. Exploitation is further constrained by Oracle EBS typically being deployed on internal networks or behind VPNs, reducing the exposed attack surface to users who already have network access and valid credentials. No special non-default configuration flag is identified in the description, but the high complexity suggests reliable exploitation is not straightforward.

The CVSS 3.1 score of 5.3 (Medium) reflects a nuanced risk profile: while the confidentiality impact is High (C:H), the attack complexity is also High (AC:H) and low privileges are required (PR:L), meaning an unauthenticated or fully unprivileged attacker cannot exploit this directly. Real-world exploitation requires both an existing foothold (authenticated session) and successful navigation of a high-complexity condition - likely a specific request ordering, race condition, or parameter manipulation that is non-trivial to reliably trigger. No EPSS score was provided, but given AC:H, low KEV/POC signal, and Oracle EBS's gated exposure (typically internal or VPN-restricted enterprise deployments), automated mass exploitation is unlikely. The primary concern is insider threat or an attacker who has already achieved low-level EBS authentication and is seeking to escalate data access within iStore. This is not a zero-click, unauthenticated threat - defenders should prioritize patching within normal Oracle CPU cycles rather than treating it as an emergency.

An authenticated low-privileged Oracle EBS user (e.g., a standard customer or internal EBS operator account) sends a specially crafted HTTP request to the iStore Shopping Cart component under a specific high-complexity condition - such as a particular parameter manipulation or session state sequence - and bypasses authorization checks, gaining read access to iStore data belonging to other users or restricted catalog/order records. No public proof-of-concept code has been identified, and the AC:H rating suggests reliable exploitation requires significant effort or specific environmental conditions.