The vulnerability exists in the Oracle Commerce Platform product, specifically in the Dynamo Application Framework component, affecting version 11.4.0. It is easily exploitable by an unauthenticated attacker over HTTP, enabling unauthorized modification (update, insert, delete) and reading of some accessible data, as well as causing a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update notice listing many products and versions but does not explicitly confirm patch availability or remediation status for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized data manipulation (update, insert, delete) and unauthorized read access to some data within Oracle Commerce Platform 11.4.0. It also allows an attacker to cause a partial denial of service, impacting availability. The confidentiality, integrity, and availability impacts are rated as low but collectively contribute to a high severity rating (CVSS 7.3).

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory content.