This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is easily exploitable by an attacker with low privileges and network access over HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within the affected product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts without availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability but does not explicitly confirm a patch or remediation level for it. Customers are advised to remain on supported versions and apply patches as they become available.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data and perform unauthorized creation, deletion, or modification of data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This compromises the confidentiality and integrity of the data but does not impact availability.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory for this vulnerability.