This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. It is exploitable by an attacker with low privileges who has logon access to the infrastructure where the product runs. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by the product. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Oracle’s advisory for the August 2026 Critical Security Patch Update mentions many patches but does not explicitly state a patch for this version or vulnerability in the provided excerpt.

Exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability affects confidentiality significantly but does not impact integrity or availability. The scope change means that other Oracle Commerce products may also be impacted by attacks leveraging this vulnerability.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Updates. However, the provided advisory content does not explicitly confirm a patch for version 11.4.0 of Oracle Commerce Guided Search / Oracle Commerce Experience Manager for this vulnerability. Users should consult the official Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, limit logon access to the infrastructure to trusted users only.