CVE-2026-21954: Medium severity Oracle Oracle Retail Xstore Point of Service vulnerability

Published Jul 21, 2026

Updated

Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is affected is 21.0.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected Software

2 affected components

Oracle Oracle Retail Xstore Point of Service=21.0.3

Oracle Retail Xstore Point of Service=21.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle Retail Applications - Xstore Point of Service (Xstore Mobile) to a version that resolves this vulnerability.
Fixed in 21.0.3

Event History

Jul 21, 2026

CVE Published

via MITRE·09:32 PM

Data Sourced

via MITRE·09:32 PM

DescriptionSeverity

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-21954?

The severity of CVE-2026-21954 is classified as medium with a CVSS score of 4.3.

How do I fix CVE-2026-21954?

To mitigate CVE-2026-21954, it is recommended to update Oracle Retail Xstore Point of Service to the latest version provided by Oracle.

Who is affected by CVE-2026-21954?

CVE-2026-21954 affects users of Oracle Retail Xstore Point of Service version 21.0.3.

What type of access is required to exploit CVE-2026-21954?

CVE-2026-21954 can be exploited by a low privileged attacker with network access via HTTP.

What components are involved in CVE-2026-21954?

CVE-2026-21954 specifically involves the Xstore Mobile component of the Oracle Retail Xstore Point of Service product.