This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is easily exploitable by a low privileged attacker with network access over HTTP, allowing compromise and potential takeover of the affected product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory from Oracle's July 2026 Critical Patch Update indicates that patches addressing this and other vulnerabilities are available, though no explicit patch link or remediation level is stated for this specific CVE. Customers are urged to apply the Critical Patch Update to remediate this issue.

Successful exploitation can lead to complete compromise and takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, affecting confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive data, modify or disrupt services, and control the affected product.

Oracle has released a Critical Patch Update in July 2026 that includes security patches addressing this vulnerability. Customers should apply the relevant patches from this update promptly. No alternative or temporary mitigations are specified. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.