This vulnerability in Oracle Commerce Platform 11.4.0's Dynamo Application Framework permits a low privileged attacker with network access over HTTP to compromise the platform. Exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without affecting availability. No known exploits in the wild have been reported. Oracle has published a Critical Patch Update advisory for July 2026 that includes multiple patches, but no explicit patch or remediation level is confirmed for this specific vulnerability in the advisory content provided.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Commerce Platform 11.4.0. This compromises confidentiality and integrity of the data but does not impact availability. The attacker requires low privileges and network access via HTTP, but the attack complexity is high, making exploitation difficult.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the vulnerability is already mitigated.