This vulnerability in Oracle Commerce Platform 11.4.0 enables an unauthenticated network attacker to compromise the platform via HTTP. Exploitation can lead to unauthorized data modification (update, insert, delete), unauthorized data disclosure (read access to some data), and partial denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts to confidentiality, integrity, and availability. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific issue. Oracle strongly recommends applying patches from their Critical Patch Updates to mitigate vulnerabilities.

Successful exploitation allows unauthorized modification and disclosure of some Oracle Commerce Platform data and can cause partial denial of service. This affects confidentiality, integrity, and availability of the platform. The vulnerability is exploitable without authentication and requires only network access via HTTP, increasing risk. No known active exploitation has been reported.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities. Although no explicit patch or remediation level is stated for this vulnerability, customers should monitor Oracle's advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply relevant patches for Oracle Commerce Platform 11.4.0 as soon as they become available. Until patched, consider restricting network access to the affected platform and monitoring for unusual activity related to HTTP access.