Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:17:56.937Z",
  "pubdate": "2026-08-18T21:17:56.937Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically within the Content Acquisition System component.\nThe vulnerability allows unauthenticated attackers with network access via HTTP to compromise the affected software, leading to significant integrity and availability impacts.\nSuccessful exploitation grants unauthorized ability to execute creation, deletion, or modification operations on critical data, as well as cause a complete denial of service through application hangs or repeatable crashes.\nThe affected supported version is 11.4.0.\nWith a CVSS 3.1 Base Score of 9.1 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, this flaw poses severe risk implications due to the lack of required authentication, low attack complexity, and network vector accessibility.",
  "technicalDetails": "The vulnerability resides in the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0.\nThe attack vector is network-based (AV:N), meaning an adversary can interact with the service remotely over HTTP without prior access to the internal network infrastructure.\nThe attack complexity is low (AC:L), requiring minimal specialized conditions or pre-existing configurations to successfully target the system.\nNo privileges are required (PR:N) and no user interaction is necessary (UI:N), allowing completely unauthenticated remote actors to initiate exploitation attempts directly against exposed endpoints.\nThe exploitation flow begins when an unauthenticated attacker sends maliciously crafted HTTP requests to the vulnerable Content Acquisition System interface.\nDue to insufficient input validation, authorization checks, or improper handling of incoming requests within the component, the application processes the malicious payload without verifying the identity or permissions of the sender.\nUpon successful processing, the payload triggers unauthorized data manipulation capabilities, allowing the attacker to create, delete, or modify critical application data and all accessible records within Oracle Commerce Guided Search / Oracle Commerce Experience Manager.\nAdditionally, the malicious payload can induce destabilizing conditions within the process execution flow, resulting in an application hang or a frequently repeatable crash that achieves a complete denial of service (DoS) for the affected system.\nThe scope remains unchanged (S:U), impacting strictly the vulnerable component and its immediate data and availability domain without directly breaching external security domains."
}