Is CVE-2026-83135 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83135 being exploited in the wild.

How severe is CVE-2026-83135?

High severity, with a CVSS score of 8.7, published 15 September 2026.

Which products and versions are affected?

Oracle E-Business Suite iStore 12.2.3 to 12.2.15.

Is there a fix for CVE-2026-83135?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-83135 attacked?

It is attacked over the network.

Am I affected by CVE-2026-83135?

Check whether you run Oracle E-Business Suite iStore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83135: Oracle iStore privilege escalation in Shopping Cart

CVE-2026-83135 · Severity: high · CVSS 8.7 · Published 2026-09-15

Oracle iStore is the e-commerce component of Oracle E-Business Suite used to power online stores and shopping functionality. A vulnerability in the Shopping Cart allows a low-privileged authenticated attacker to manipulate critical business data—including unauthorized creation, deletion, or modification of orders, products, or customer records—and access confidential information. The attack requires tricking another user into performing an action, but the impact extends beyond iStore to potentially compromise other E-Business Suite modules.

Technologies: Oracle E-Business Suite iStore. Vendors: Oracle.

Quick answers

Is CVE-2026-83135 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83135 being exploited in the wild.
How severe is CVE-2026-83135?: High severity, with a CVSS score of 8.7, published 15 September 2026.
Which products and versions are affected?: Oracle E-Business Suite iStore 12.2.3 to 12.2.15.
Is there a fix for CVE-2026-83135?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-83135 attacked?: It is attacked over the network.
Am I affected by CVE-2026-83135?: Check whether you run Oracle E-Business Suite iStore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a privilege escalation vulnerability in the Oracle iStore Shopping Cart component affecting versions 12.2.3 through 12.2.15. The vulnerability is easily exploitable via HTTP and requires a low-privileged user account plus user interaction (likely CSRF or similar social engineering vector). The root cause involves insufficient access controls or authorization checks in the Shopping Cart, permitting authenticated users to perform unauthorized operations on critical data. Successful exploitation allows reading, creating, modifying, or deleting Oracle iStore data and potentially impacting connected E-Business Suite systems due to scope change. Oracle has released patches; users should apply updates for their supported version immediately.

Affected products

Oracle E-Business Suite iStore 12.2.3 to 12.2.15

Timeline

2026-09-15: disclosed

References

https://www.oracle.com/security-alerts/cspusep2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.