CVE-2026-60817: Oracle iStore Auth Bypass Vulnerability

CVE-2026-60817 Overview

CVE-2026-60817 is a high-severity vulnerability in the Oracle iStore product of Oracle E-Business Suite, specifically within the Shopping Cart component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this weakness to compromise Oracle iStore. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all Oracle iStore accessible data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
An authenticated attacker over the network can read and modify all Oracle iStore accessible data, impacting confidentiality and integrity of e-commerce transactions and customer records.

Affected Products

Oracle E-Business Suite - Oracle iStore version 12.2.3
Oracle E-Business Suite - Oracle iStore versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle iStore version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60817 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the vulnerability in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60817

Vulnerability Analysis

The vulnerability resides in the Shopping Cart component of Oracle iStore, a business-to-business and business-to-consumer e-commerce module within Oracle E-Business Suite. The flaw is classified as easily exploitable and requires only low privileges, meaning any authenticated user account with basic iStore access can weaponize it. Exploitation occurs over HTTP without user interaction. The impact spans both confidentiality and integrity: an attacker can read, create, modify, or delete all data accessible to Oracle iStore. Availability is not affected, indicating the exploit does not disrupt service continuity. The EPSS score stands at 0.365% with a percentile of 29, reflecting current exploitation likelihood in the near term.

Root Cause

Oracle has not published detailed technical root-cause information. Based on the CVSS profile and component affected, the weakness is consistent with a broken access control or input validation issue in the Shopping Cart workflow that allows a low-privileged authenticated user to escalate data access beyond their intended scope. Refer to the Oracle Critical Patch Update Advisory - July 2026 for vendor-provided details.

Attack Vector

Exploitation is remote and requires only HTTP access to the Oracle iStore interface. The attacker must hold a low-privileged account, which in many iStore deployments includes self-registered customer users. Once authenticated, the attacker interacts with the Shopping Cart component through crafted HTTP requests to gain unauthorized read and write access to iStore data. No user interaction is needed on the victim side, and the scope remains unchanged, meaning the impact is contained within the iStore application boundary.

No verified public proof-of-concept exploit code is available at the time of publication. See the Oracle Security Alert - July 2026 for authoritative technical guidance.

Detection Methods for CVE-2026-60817

Indicators of Compromise

Unexpected creation, modification, or deletion of records in Oracle iStore Shopping Cart tables by low-privileged accounts.
HTTP requests to iStore Shopping Cart endpoints originating from accounts that historically only browse the storefront.
Anomalous volumes of cart, order, or customer profile queries returning data outside the requesting user's scope.
Database audit entries showing access to iStore data by users lacking merchant or administrator roles.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and iStore application-level auditing to record Shopping Cart operations per user.
Correlate application logs with database audit trails to identify authenticated sessions accessing data outside their normal profile.
Deploy a web application firewall in front of the iStore front-end and log all POST and GET traffic to Shopping Cart URLs for anomaly analysis.
Baseline normal HTTP request patterns per user role and alert on deviations targeting iStore endpoints.

Monitoring Recommendations

Forward Oracle E-Business Suite application, Apache/OHS access, and database audit logs to a central SIEM for cross-source correlation.
Alert on privilege-context mismatches where a low-privileged session accesses or modifies high-value cart or customer records.
Track failed and successful authentication events against iStore and flag brute-force or credential-stuffing precursors.

How to Mitigate CVE-2026-60817

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running iStore 12.2.3 through 12.2.15.
Inventory all iStore deployments and confirm the running version against the affected range before scheduling maintenance windows.
Restrict internet exposure of the iStore application to only the endpoints required for business operations.
Review low-privileged and self-registered accounts and disable or audit those exhibiting anomalous Shopping Cart activity.

Patch Information

Oracle released fixes for CVE-2026-60817 as part of the July 2026 Critical Patch Update. Administrators should download and apply the relevant Oracle E-Business Suite 12.2 patches referenced in the Oracle Critical Patch Update Advisory - July 2026. Apply the patches in a test environment first and validate iStore checkout, catalog, and account workflows before production rollout.

Workarounds

If patching cannot be performed immediately, place the iStore front-end behind a web application firewall with rules restricting access to Shopping Cart endpoints.
Require multi-factor authentication for iStore accounts where the application supports it to raise the bar on account abuse.
Temporarily disable self-registration if not business-critical to reduce the pool of low-privileged accounts available to attackers.
Increase logging verbosity and monitoring frequency on iStore Shopping Cart activity until the patch is deployed.

bash

# Verify installed Oracle E-Business Suite patch level before and after CPU application
# Run from the APPL_TOP as the applmgr user
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 ORDER BY last_update_date DESC;
EOF

# Confirm the July 2026 CPU bundle patch for Oracle E-Business Suite 12.2 is present
# Reference the Oracle CPU advisory for the exact bundle patch numbers