This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Content Acquisition System component) version 11.4.0. It is easily exploitable by unauthenticated attackers over HTTP, enabling unauthorized creation, deletion, or modification of critical or all accessible data within the affected product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

Successful exploitation allows attackers to compromise critical data by unauthorized creation, deletion, or modification, leading to a complete loss of confidentiality and integrity of all accessible data in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. Availability is not impacted. This could result in significant data breaches or manipulation within affected environments.

Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.