This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Content Acquisition System component) version 11.4.0. It is easily exploitable remotely without authentication via HTTP. The flaw allows attackers to gain unauthorized access to modify critical data and to cause a complete denial of service by hanging or repeatedly crashing the service. The CVSS 3.1 base score is 9.1, reflecting high integrity and availability impacts. No confidentiality impact is noted. The vulnerability is tracked as CWE-284 (Improper Access Control).

An attacker can remotely and unauthenticatedly manipulate critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager or cause a complete denial of service by crashing or hanging the service. This compromises data integrity and availability of the affected system.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate this issue. The vendor advisory does not indicate that no action is required or that the issue is already mitigated without patching. Patch status is confirmed by the vendor advisory. Refer to the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.