Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:17:56.463Z",
  "pubdate": "2026-08-18T21:17:56.463Z",
  "executiveSummary": "An easily exploitable security vulnerability affects the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This flaw allows an unauthenticated remote attacker with network access via HTTP to interact with the vulnerable application and compromise system integrity and availability.\nSuccessful exploitation of this vulnerability grants unauthorized capabilities to perform critical data manipulation, including the unauthorized creation, deletion, or modification of all accessible data within the Oracle Commerce Guided Search / Oracle Commerce Experience Manager environment. Furthermore, attackers can trigger a complete denial of service (DoS) state, resulting in a system hang or a frequently repeatable application crash.\nThe vulnerability carries a CVSS 3.1 Base Score of 9.1 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, highlighting severe risks to data integrity and service availability. The attack vector is strictly network-based, requires low attack complexity, and mandates no privileges or user interaction, representing a critical risk to exposed deployments.",
  "technicalDetails": "The vulnerability resides within the Content Acquisition System (CAS) component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The underlying root cause involves insecure handling of incoming network requests over the HTTP protocol, which lacks proper validation, authorization checks, or robust error handling mechanisms.\nAttackers can exploit this flaw remotely via standard HTTP requests without requiring any pre-existing authentication credentials or user interaction. Due to the low attack complexity and network accessibility, an external actor can directly target the exposed interfaces of the Content Acquisition System to interact with internal application logic.\nThe attack flow proceeds as follows: First, the unauthenticated attacker establishes network connectivity to the vulnerable Oracle Commerce Guided Search / Oracle Commerce Experience Manager instance over HTTP. Second, the attacker transmits maliciously crafted HTTP payloads targeting the vulnerable Content Acquisition System component. Third, because the application fails to properly enforce access controls or validate request integrity, the malicious payload is processed by the underlying functions.\nUpon successful processing, the payload executes unauthorized operations against critical data stores. This results in the unauthorized creation, modification, or deletion of sensitive or critical data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Additionally, the crafted input can destabilize the application architecture, exhausting system resources or triggering fatal exceptions that lead to an immediate system hang or a frequently repeatable application crash, culminating in a complete denial of service.\nPost-exploitation impacts are strictly constrained to integrity and availability, as confidentiality is not directly impacted according to the CVSS metrics. However, the ability to destroy or modify critical data combined with the capacity to induce persistent service outages poses an existential threat to the operational continuity of the affected Oracle Commerce deployment."
}