Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:17:56.337Z",
  "pubdate": "2026-08-18T21:17:56.337Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Commerce Guided Search and Oracle Commerce Experience Manager product, specifically targeting the Content Acquisition System component in version 11.4.0. This network-based security flaw allows unauthenticated attackers to interact with the system via HTTP, posing severe risk implications to enterprise environments. Successful exploitation requires no user interaction and low attack complexity, granting unauthorized threat actors the capability to compromise critical data integrity and system availability. The impact profile includes unauthorized creation, deletion, or modification of accessible data, as well as the ability to trigger a complete denial of service through a system hang or repeatable application crash. Given the CVSS 3.1 base score of 9.1 with high integrity and availability impacts, immediate remediation and network hardening are imperative to prevent malicious operational disruption and data tampering.",
  "technicalDetails": "The vulnerability resides within the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The root cause stems from improper input validation or insufficient access controls within the network-exposed HTTP interface, allowing unauthenticated remote clients to invoke sensitive administrative or data-processing functions. Because the vulnerability requires zero privileges and no user interaction, an external attacker with network access via HTTP can directly interact with vulnerable endpoints. The attack flow begins when an attacker crafts a malicious HTTP request directed against the Content Acquisition System component. Due to the lack of adequate authentication and authorization mechanisms, the application processes the request without verifying the identity or privileges of the sender. The payload behavior allows the execution of unauthorized operations, specifically targeting data integrity by enabling the creation, modification, or deletion of critical application data. Furthermore, malicious payloads can be structured to exhaust system resources or trigger unhandled exceptions within the underlying application logic, leading to a complete denial of service characterized by a system hang or a frequently repeatable application crash. The post-exploitation impact spans severe data corruption, unauthorized data manipulation, and sustained operational downtime, completely undermining the availability and reliability of the Oracle Commerce Guided Search / Oracle Commerce Experience Manager infrastructure."
}