This vulnerability in Oracle Commerce Platform 11.4.0 allows an unauthenticated attacker with network access over HTTP to compromise the platform by unauthorized creation, deletion, or modification of critical data or unauthorized access to all accessible data. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact without availability impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which addresses numerous vulnerabilities across Oracle products, but explicit patch details for Oracle Commerce Platform 11.4.0 are not detailed in the advisory excerpt provided.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle Commerce Platform 11.4.0. This compromises confidentiality and integrity of the platform's data, potentially affecting business operations relying on the platform's data integrity and confidentiality.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a patch for Oracle Commerce Platform 11.4.0. Customers are strongly advised to consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected platform and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.