Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-18T21:17:57.753Z",
  "pubdate": "2026-08-18T21:17:57.753Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This security flaw allows a low-privileged attacker with network access via HTTP to compromise the affected application. The vulnerability possesses a CVSS 3.1 Base Score of 7.7, with high confidentiality impact and a scope change indicating that successful exploitation may significantly impact additional products beyond the immediate software boundary.\nThe primary risk stems from unauthorized access to critical data, granting a malicious actor complete access to all data accessible via Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Exploitation requires low privileges, no user interaction, and network connectivity over HTTP. Due to the broad scope and significant impact on data confidentiality, immediate defensive and remedial actions are critical to secure the affected environment.",
  "technicalDetails": "The vulnerability resides within the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. Specifically, the attack surface is exposed via network protocols using HTTP, allowing remote threat actors to interact with vulnerable backend routines without requiring complex user interaction.\nAttack flow and exploitation mechanics involve a low-privileged authenticated user leveraging network access to send specially crafted HTTP requests to the Content Acquisition System. Due to insufficient input validation, authorization checks, or access control enforcement within the vulnerable component, the application processes the request and returns unauthorized sensitive data.\nThe attack prerequisites dictate that the adversary must possess valid low-privileged credentials and network connectivity to the HTTP interface exposed by the Oracle Commerce Guided Search / Oracle Commerce Experience Manager deployment. Because the vulnerability features a scope change (S:C), the compromise is not strictly contained within the Content Acquisition System, potentially allowing cascading data access impacts across integrated or adjacent third-party products and services.\nPost-exploitation impact is characterized by severe confidentiality breaches. The attacker can extract critical data and achieve complete read access to all data repositories and stores accessible through the Oracle Commerce Guided Search / Oracle Commerce Experience Manager architecture. Integrity and availability impacts remain unaffected as per the vector parameters, focusing the threat strictly on unauthorized information disclosure."
}