Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-18T21:17:58.200Z",
  "pubdate": "2026-08-18T21:17:58.200Z",
  "executiveSummary": "An elevation of privilege vulnerability exists within the Oracle Commerce Guided Search and Oracle Commerce Experience Manager product, specifically targeting the Content Acquisition System component in version 11.4.0. This flaw presents a significant security risk, rated with a CVSS 3.1 Base Score of 7.0, due to its potential to cause complete system compromise affecting confidentiality, integrity, and availability. Successful exploitation of this vulnerability allows a malicious actor to achieve a total takeover of the affected application.\nThe vulnerability is characterized as difficult to exploit, requiring specific preconditions. An attacker must possess low-privileged access and valid logon capabilities to the underlying infrastructure where the Oracle Commerce Guided Search and Oracle Commerce Experience Manager services execute. User interaction is not required for a successful attack, and the attack vector remains strictly local (AV:L), leveraging high attack complexity (AC:H) conditions within the host environment. Organizations utilizing the specified version face severe operational risks if unauthorized local users can escalate their privileges to assume full control over the Commerce infrastructure.",
  "technicalDetails": "The vulnerability resides within the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The root cause stems from insecure handling of local resources, permissions, or process execution contexts within the infrastructure where the software executes. Because the attack vector is local (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N), the security boundary relies heavily on the underlying operating system access controls and the secure configuration of the runtime environment.\nExecution of the attack requires the adversary to already possess authenticated logon access to the host operating system. Due to the high attack complexity (AC:H), successful exploitation typically demands specific environmental prerequisites, such as race conditions, predictable temporary file creation, misconfigured file system permissions, or improper handling of local inter-process communication channels by the Content Acquisition System. The attacker leverages these local primitives to manipulate execution flows, inject unauthorized instructions, or abuse legitimate administrative functionalities exposed insecurely by the vulnerable component.\nThe attack flow proceeds in discrete phases: First, the low-privileged attacker establishes an interactive or programmatic logon session on the target infrastructure hosting the Oracle Commerce deployment. Second, the attacker probes the local environment to identify weaknesses in how the Content Acquisition System interacts with local files, registry entries, or system services. Third, by exploiting the high-complexity local flaw, the attacker crafts a malicious payload or input sequence designed to manipulate the application runtime. Finally, upon successful execution of the exploit payload, the attacker elevates privileges within the application context, resulting in the complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The resulting post-exploitation impact grants the adversary unrestricted control over application data, business logic, and system availability."
}