This vulnerability in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework) permits an unauthenticated remote attacker with network access over HTTP to compromise the platform. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by the platform. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches across Oracle products, but explicit patch status for this vulnerability is not detailed in the advisory content provided.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Commerce Platform 11.4.0, as well as unauthorized access to all data accessible by the platform. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability is rated high severity with a CVSS 3.1 score of 7.4.

The vendor advisory references Oracle's July 2026 Critical Patch Update, which addresses multiple vulnerabilities across Oracle products. However, the advisory content provided does not explicitly confirm the availability of a patch or fix for Oracle Commerce Platform 11.4.0 regarding this vulnerability. Therefore, patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions.