What is the CVSS score of EUVD-2026-47125?

EUVD-2026-47125 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle iStore are affected by EUVD-2026-47125?

Oracle iStore (E-Business Suite 12.2.3-12.2.15) contains a broken access control vulnerability allowing authenticated users with low system privileges to read, modify, and delete all iStore…

How to fix or mitigate EUVD-2026-47125?

Within 24 hours, identify all Oracle E-Business Suite 12.2.3 through 12.2.15 systems running iStore and determine whether they are exposed to network-authenticated users (including indirect access via integrations or admin accounts). Within 7 days, restrict iStore access to trusted internal networks if not yet patched, and enable audit logging on iStore data access to detect unauthorized reads or modifications. Within 30 days, apply the Oracle July 2026 Critical Patch Update to all affected systems, or disable the iStore application until the patch is deployed.

Oracle iStore EUVD-2026-47125

| CVE-2026-60817 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jgp5-vwg4-c6c3

Authentication Bypass Oracle Istore

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and no interaction, but a low-privilege account is required (PR:L); high confidentiality/integrity data impact, no availability effect (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:57 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iStore accessible data as well as unauthorized access to critical data or complete access to all Oracle iStore accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Broken access control in the Shopping Cart component of Oracle iStore (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the iStore application over HTTP. Tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 8.1 driven by high confidentiality and integrity impact with no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle iStore is the customer-facing e-commerce storefront module of Oracle E-Business Suite, Oracle's enterprise ERP/CRM application stack. The flaw resides in the Shopping Cart component and is reachable over HTTP through the standard web front-end. No CWE was assigned by Oracle (CWE: N/A), but the vendor tag 'Authentication Bypass' combined with the CVSS profile (low privileges required, unauthorized read plus create/modify/delete across all iStore-accessible data) points to a broken-access-control / authorization weakness (CWE-284/CWE-639 class) where an authenticated low-privilege user can escalate their reach to data they should not be able to touch. No CPE strings were provided in the input; affected products are identified from Oracle's advisory and the ENISA EUVD record rather than NVD CPE data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish a separate patched sub-version string for iStore beyond the CPU, so administrators should install the CPU patch corresponding to their EBS 12.2.x level. No exact standalone fix version was provided in the input, so do not substitute an invented version number - follow the CPU patch mapping. Until patching is complete, reduce exposure by restricting network access to the iStore storefront (limit HTTP access to trusted networks or place it behind a WAF that can inspect Shopping Cart requests), tightening or disabling anonymous/self-service account registration to raise the bar for obtaining the low-privilege account the attack requires, and increasing monitoring/auditing of Shopping Cart data-access operations; note these controls can degrade legitimate customer self-service and are stopgaps, not substitutes for the CPU.