This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, specifically the Content Acquisition System component. It is easily exploitable by unauthenticated attackers over the network via HTTP, allowing full compromise of the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the impact is high across confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide a discrete patch link or remediation level for this specific issue. Customers should consult the advisory and apply the cumulative patches as recommended.

Successful exploitation results in complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, impacting confidentiality, integrity, and availability of the system. This can lead to unauthorized access, data compromise, and disruption of service. The vulnerability is exploitable remotely without authentication, increasing the risk of widespread impact if left unmitigated.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While no specific patch link or remediation level is provided for this exact vulnerability, Oracle strongly recommends that customers apply the cumulative security patches from the July 2026 CPU without delay. Patch status is not yet confirmed explicitly for version 11.4.0; therefore, customers should monitor the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and instructions. No vendor advisory states that no action is required or that the issue is already mitigated.