Oracle iStore EUVD-2026-47125

Exploitation requires network HTTP access to an Oracle iStore deployment running an affected E-Business Suite version (12.2.3-12.2.15) with the Shopping Cart component in use, plus a low-privilege authenticated account (CVSS PR:L) - not a fully unauthenticated flaw, though iStore's self-service registration often makes acquiring such an account easy. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the target must be an internet- or network-reachable iStore instance, the attacker must first authenticate at least as a low-privilege user, and only iStore-accessible data is in scope (S:U, no availability/system impact). The 'Authentication Bypass' tag combined with PR:L suggests the flaw lets an already-authenticated low-privilege user bypass authorization boundaries rather than bypass login entirely - verify the exact mechanism against Oracle's advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with data theft and tampering rather than service disruption. Because PR:L is specified, this requires some form of authenticated access (any low-privilege iStore account), which modestly limits exposure compared to a fully unauthenticated flaw, yet iStore storefronts frequently allow self-service account registration, so obtaining a low-privilege account can be trivial in practice. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the risk rating rests on the CVSS profile and the sensitivity of ERP data. Absence of exploit intelligence is not evidence of low risk - Oracle EBS is a historically high-value target, so this should be prioritized on the strength of impact and ease of exploitation despite the missing EPSS/KEV signals.

An attacker registers or obtains a low-privilege iStore storefront account, authenticates over HTTP, and manipulates Shopping Cart requests to reference or alter objects belonging to other users or to data they are not authorized to access. Leveraging the authorization weakness, they read sensitive customer/order data and create, modify, or delete records across the iStore application. No public exploit is identified at time of analysis, and the low attack complexity means a working request could be developed with modest effort once the authorization gap is understood.