This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, specifically the Content Acquisition System component. An unauthenticated attacker with network access via HTTP can exploit this flaw to gain unauthorized ability to create, delete, or modify critical data within the affected product. Additionally, the attacker can cause the system to hang or crash repeatedly, leading to a complete denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. Oracle has published a Critical Security Patch Update advisory recommending patch application but no explicit patch link was provided in the input data.

Successful exploitation can result in unauthorized modification of critical data or all accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. It can also cause denial of service by hanging or crashing the system repeatedly. The integrity and availability of the affected system are severely impacted, but confidentiality is not affected according to the CVSS vector.

Oracle has released a Critical Security Patch Update (CSPU) that addresses this vulnerability. Customers are strongly advised to apply the relevant security patches promptly to mitigate the risk. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions.