Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:17:56.710Z",
  "pubdate": "2026-08-18T21:17:56.710Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically within the Content Acquisition System component supporting version 11.4.0. This security flaw allows unauthenticated remote attackers with network access via the HTTP protocol to compromise the targeted system without requiring user interaction.\nSuccessful exploitation of this vulnerability leads to severe security implications, characterized by high impacts on integrity and availability, yielding a CVSS 3.1 Base Score of 9.1. An unauthorized threat actor can achieve complete Denial of Service (DoS) conditions through application hangs or repeatable crashes, alongside unauthorized creation, deletion, or modification of critical data or all accessible data within the application.\nGiven the lack of required authentication, low attack complexity, and network-vector exposure, the risk implications are critical. Organizations running the affected Oracle Commerce version must prioritize defensive measures to mitigate potential unauthorized data tampering and service unavailability.",
  "technicalDetails": "The vulnerability resides in the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The root cause stems from insufficient validation and access controls within network-exposed HTTP endpoints, allowing unauthenticated remote interactions to manipulate or disrupt underlying system services.\nAttackers leverage the network attack vector by transmitting crafted HTTP requests directly to the vulnerable Content Acquisition System component. Because the vulnerability requires no privileges (PR:N) and zero user interaction (UI:N), an external adversary can initiate the attack sequence immediately upon establishing network connectivity over HTTP to the target application.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies the accessible HTTP services exposed by the Content Acquisition System. Second, the attacker crafts malicious payloads designed to bypass or exploit the inadequate input validation and access enforcement mechanisms of the component. Third, upon transmitting the payload, the application processes the unauthorized instructions.\nThis processing results in two primary post-exploitation impacts. Regarding integrity, the attacker gains unauthorized capabilities to create, delete, or modify critical data as well as any other data accessible to Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Regarding availability, the payload triggers conditions that cause the application to hang or experience frequently repeatable complete crashes, denying service to legitimate users.\nThe attack complexity is rated as low (AC:L), indicating that successful exploitation does not require specialized conditions or advanced circumvention techniques, making the vulnerability highly reliable for malicious actors targeting the specified product version."
}