This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Content Acquisition System component) version 11.4.0. It is easily exploitable remotely without authentication over HTTP. Successful exploitation can lead to unauthorized modification of critical or all accessible data and cause a hang or frequent crashes, resulting in a complete denial of service. The CVSS 3.1 base score is 9.1, reflecting high integrity and availability impacts with no confidentiality impact.

An attacker can gain unauthorized ability to create, delete, or modify critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager, potentially compromising data integrity. Additionally, the attacker can cause the system to hang or crash repeatedly, resulting in a complete denial of service and impacting availability. There is no confidentiality impact reported.

Oracle has released a Critical Security Patch Update that addresses this vulnerability. Customers are strongly advised to apply the relevant security patches without delay to mitigate this risk. The vendor advisory emphasizes remaining on actively supported versions and promptly applying patches. Patch availability details should be confirmed via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.