CVE-2026-83135

Oracle iStore, the e-commerce storefront module of Oracle E-Business Suite, contains an easily exploitable flaw in its Shopping Cart component affecting versions 12.2.3 through 12.2.15. A low-privileged, authenticated attacker with HTTP access to the iStore storefront can trigger the flaw, but successful exploitation requires a victim other than the attacker to interact with the attack (a phishing- or CSRF-style pattern), and the scope change means the impact can extend beyond iStore to additional products. A successful attack yields unauthorized creation, deletion, or modification of critical data and full read access to all data reachable through Oracle iStore. The vulnerability carries a CVSS 3.1 base score of 8.7, reflecting high confidentiality and integrity impacts with no availability impact. No public proof of concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so there is no indication of active exploitation at this time.

What to do: Apply the Oracle Critical Patch Update that addresses this vulnerability to every EBS 12.2 environment running iStore 12.2.3-12.2.15, and verify the storefront is included in your patching scope since optional modules are often missed. Until patched, restrict HTTP access to the iStore storefront to trusted networks or VPN ranges and train users to treat unsolicited links aimed at EBS sessions with suspicion given the required user interaction. Review audit logs for unexpected creation, deletion, or modification of iStore-accessible data to rule out prior exploitation.