This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. It is an easily exploitable flaw that requires no authentication and can be triggered remotely over HTTP. Successful exploitation can lead to full compromise of the affected system, including takeover of the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory from Oracle references a Critical Patch Update released in July 2026 containing numerous patches, including for this product, but does not explicitly confirm patch availability or remediation details for this specific vulnerability within the advisory text provided.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain full control over Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This compromises confidentiality, integrity, and availability of the affected system, potentially allowing data theft, unauthorized changes, and service disruption.

Patch status is not yet confirmed — check the Oracle Critical Patch Update Advisory for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict network access to the affected service where possible to reduce exposure.