Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:57.637Z",
  "pubdate": "2026-08-18T21:17:57.637Z",
  "executiveSummary": "A vulnerability has been identified in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically within the Content Acquisition System component affecting version 11.4.0. This security flaw is classified as an easily exploitable vulnerability that allows an unauthenticated remote attacker with network access via HTTP to compromise the confidentiality of the targeted system. Successful exploitation of this vulnerability directly results in unauthorized access to critical data or complete access to all data accessible within the Oracle Commerce Guided Search / Oracle Commerce Experience Manager environment. The severity of this issue is reflected by a CVSS 3.1 Base Score of 7.5, with an impact strictly limited to confidentiality (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The attack vector is network-based, requiring low attack complexity, zero privileges, and no user interaction, making it a critical risk for deployments utilizing the affected version without compensating controls.",
  "technicalDetails": "The vulnerability resides in the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The root cause stems from improper input validation or insufficient access control enforcement mechanisms within the HTTP request handling architecture of the vulnerable component. Because the attack vector is network-based (AV:N), adversaries can interact directly with the vulnerable service over standard HTTP protocols without requiring prior access to the internal network perimeter. The attack complexity is rated as low (AC:L), indicating that the conditions or configurations required to execute the exploit are consistently present and do not demand specialized race conditions or complex cryptographic bypasses. Furthermore, the vulnerability requires no privileges (PR:N) and no user interaction (UI:N), meaning an unauthenticated external actor can initiate exploitation independently. During an attack flow, the malicious actor crafts a specific HTTP request targeting the Content Acquisition System component to bypass security boundaries. Due to the lack of adequate authentication and authorization checks, the application processes the request and improperly discloses sensitive backend data. The payload behavior centers on retrieving unauthorized information, leading to severe confidentiality impacts (C:H) by exposing critical or complete application data sets. Integrity and availability remain unaffected, as indicated by the CVSS metrics (I:N/A:N), limiting the immediate post-exploitation phase to unauthorized data exfiltration rather than remote code execution or denial of service."
}