This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, specifically within the Content Acquisition System component. It allows an unauthenticated attacker over the network via HTTP to compromise the system, potentially gaining unauthorized access to sensitive data or full access to all data accessible by the product. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.8, reflecting a high confidentiality impact but no integrity or availability impact. The vulnerability is difficult to exploit and may impact other Oracle Commerce products due to scope change. Oracle's advisory references a Critical Security Patch Update released in August 2026 that includes fixes for this vulnerability among many others. Customers are strongly advised to apply the relevant patches to mitigate risk.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability is difficult to exploit and requires network access via HTTP without authentication. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are indicated beyond applying the official patch.