This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. An unauthenticated attacker who has logon access to the infrastructure where the product runs can exploit this vulnerability to cause the application to hang or crash repeatedly, resulting in a complete denial of service. The CVSS vector indicates low attack complexity and no privileges required, but local attack vector (logon to infrastructure) is necessary. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue.

Successful exploitation results in a denial of service condition by causing the Oracle Commerce Guided Search / Oracle Commerce Experience Manager to hang or crash repeatedly. There is no impact on confidentiality or integrity. The availability impact is high, leading to potential service disruption.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available. Until a patch is confirmed, restrict logon access to the infrastructure hosting the affected product to trusted users only to reduce risk.