This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. An unauthenticated attacker with logon access to the underlying infrastructure can exploit this flaw, but exploitation requires user interaction from a third party. The vulnerability can result in unauthorized access to critical data or complete access to all data accessible by the product. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) indicates the attack vector is local with low attack complexity, no privileges required, but requires user interaction, and impacts confidentiality with a scope change.

Successful exploitation can lead to unauthorized access to critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and may affect additional Oracle products due to scope change. The confidentiality impact is high, but integrity and availability are not affected. The attack requires local access and user interaction, limiting remote exploitation.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate this issue. No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, patching must be applied by the customer. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.