This vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 allows an attacker with low privileges and network access over HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed and listed in Oracle's July 2026 Critical Patch Update advisory, which includes a large number of patches across Oracle products. However, the advisory does not explicitly confirm the availability of a patch or fix for this specific CVE.

Successful exploitation can result in complete compromise of Oracle Commerce Guided Search and Oracle Commerce Experience Manager, impacting confidentiality, integrity, and availability of the affected systems. This could allow attackers to take over the affected product components, potentially leading to unauthorized access, data manipulation, and service disruption.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected services where possible to reduce exposure.