This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, specifically the Content Acquisition System component. It permits an unauthenticated attacker with network access over HTTPS to compromise the system, potentially leading to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability but does not explicitly state a fix or remediation level for it. The vulnerability is rated high severity with no known exploits reported.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits are currently reported in the wild.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or remediation for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant patches promptly. Until an official patch or mitigation is confirmed, organizations should consider restricting network access to the affected service and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.