This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can lead to complete compromise of the affected product, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references the July 2026 Critical Patch Update, which includes numerous patches across Oracle products, but does not explicitly confirm a patch for this specific vulnerability or version.

The vulnerability allows an attacker with low privileges and network access to fully compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This can result in complete takeover of the product, affecting confidentiality, integrity, and availability of the system.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or fix for version 11.4.0 of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Customers are strongly advised to review the July 2026 Critical Patch Update advisory directly at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant security patches promptly. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.