This vulnerability affects Oracle Commerce Platform 11.4.0 and permits an unauthenticated attacker with network access through LDAP to compromise the platform. The attack can result in unauthorized access to critical data or complete access to all data accessible by the platform. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue. The advisory strongly recommends applying security patches promptly, but no direct patch link or fix is provided in the input data.

Exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible by the Oracle Commerce Platform 11.4.0. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely without authentication, increasing risk to affected deployments.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed, restrict network access to LDAP interfaces of Oracle Commerce Platform 11.4.0 to trusted sources only.