This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, specifically in the Content Acquisition System component. An unauthenticated attacker with network access via HTTP could exploit this difficult-to-exploit vulnerability to gain unauthorized access to critical data or full access to all accessible data within the product. The vulnerability has a CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability may also impact other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 security patches across multiple Oracle product families. No explicit patch link for this specific vulnerability was provided, but Oracle strongly recommends applying available patches promptly.

Successful exploitation can result in unauthorized access to critical data or complete access to all accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The vulnerability affects confidentiality but does not impact integrity or availability. Due to scope change, additional Oracle products may be significantly impacted by attacks exploiting this vulnerability.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability along with many others. Customers are strongly advised to remain on actively supported versions and apply Oracle's security patches without delay. Since this is not a cloud service, patching must be performed by the customer. No indication was given that no action is required or that the issue is already mitigated without patching.