A vulnerability in the Oracle Commerce Platform 11.4.0, specifically the Dynamo Commerce Server component, allows an attacker with low privileged access and network reach via HTTP to create, delete, or modify critical data as well as read a subset of data. The flaw provides both confidentiality and integrity impacts and enables unauthorized creation, deletion or modification of data. The description indicates that the vulnerability is easily exploitable and could lead to unauthorized data manipulation without any user interaction.

Oracle Corporation’s Oracle Commerce Platform, version 11.4.0, is affected. The vulnerability exists in the Dynamo Commerce Server component used by this product. Users running this exact version must take action, while later or earlier versions are not listed as affected in the available information.

The CVSS 3.1 base score of 7.1 denotes a medium-high severity with medium complexity and low privilege requirements. The EPSS score is not available, and the CVE is not in CISA KEV. The likely attack vector is a non‑authenticated HTTP request to the Commerce Server, and the threat is considered easily exploitable due to its low attack complexity and lack of user interaction requirement. The potential impact includes unauthorized data creation, deletion, modification, and read access, compromising both confidentiality and integrity of the system data.