This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Content Acquisition System component) version 11.4.0. It is easily exploitable by unauthenticated attackers over HTTP, enabling unauthorized modification of critical or all accessible data and the ability to cause a hang or frequent crashes leading to a complete denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager, compromising data integrity. It also allows attackers to cause a hang or frequent crashes, resulting in a complete denial of service, impacting availability. There is no confidentiality impact reported.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of applying available patches without delay. Patch availability for this specific product and version should be confirmed via the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or workarounds are specified.