This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. It is an easily exploitable flaw that enables a low privileged attacker with network access over HTTP to take over the affected product. The vulnerability impacts the Content Acquisition System component and has a CVSS 3.1 score of 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Although the vulnerability is localized to Oracle Commerce Guided Search / Experience Manager, successful exploitation may affect other Oracle products. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue. Customers are urged to apply available patches from the Critical Patch Update promptly.

Successful exploitation can lead to complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, compromising confidentiality, integrity, and availability of the system. The attack requires only low privileges and network access via HTTP, making it easily exploitable. The vulnerability may also have a scope change effect, impacting additional Oracle products beyond the initially affected component.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends customers remain on actively supported versions and apply security patches without delay. No specific temporary mitigations or workarounds are provided in the advisory.