This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data accessible through the product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impact with no user interaction required. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch or remediation level for this specific issue, though it references a large set of cumulative patches. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This results in a high impact on confidentiality and integrity of the affected data. Availability is not impacted. The attacker requires only low privileges and network access via HTTP, increasing the risk of compromise.

Patch status is not yet confirmed—check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly when available. Until a patch is confirmed and applied, restrict network access to the affected service to trusted users only and monitor for unusual activity related to Oracle Commerce Guided Search / Experience Manager.