This vulnerability affects Oracle Commerce Service Center 11.4.0 and allows an unauthenticated attacker with network access via HTTP to compromise the system. The attack requires user interaction from a third party and can result in unauthorized modification (update, insert, delete) and partial unauthorized reading of accessible data. The vulnerability has a CVSS 3.1 score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and limited confidentiality and integrity impact. The vendor advisory linked does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to unauthorized update, insertion, or deletion of some accessible data within Oracle Commerce Service Center, as well as unauthorized read access to a subset of data. This impacts the confidentiality and integrity of the system's data. There is no impact on availability. The vulnerability also has scope change implications, potentially affecting additional Oracle Commerce products beyond the Service Center itself.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly when available. Until a patch is confirmed, organizations should consider limiting network exposure of Oracle Commerce Service Center and educate users to avoid interacting with suspicious content that could trigger exploitation.