PT-2026-62130 · Oracle · Oracle Retail Xstore Point Of Service

CVE-2026-21954 · Published 2026-07-21 · Updated 2026-07-21

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is affected is 21.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Fix

Related Identifiers

CVE-2026-21954

Affected Products

Oracle Retail Xstore Point Of Service

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-21954 · Security Note
• https://oracle.com/security-alerts/cpujul2026.html · Vendor Advisory