This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in unauthorized access to critical data and unauthorized modification (update, insert, delete) of some accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory linked does not explicitly state a patch or remediation for this vulnerability, only general recommendations to apply Critical Patch Updates promptly. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and unauthorized modification of some data (update, insert, delete). This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network via HTTP by an attacker with low privileges.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends customers remain on actively-supported versions and apply security patches without delay. Until a specific patch is confirmed, monitor Oracle's Critical Patch Update advisories for updates addressing this vulnerability.