This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to unauthorized access to critical data and partial unauthorized modification capabilities (update, insert, delete) on the data accessible by the affected product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory linked does not explicitly confirm patch availability or remediation status for this specific vulnerability but references a Critical Patch Update containing many fixes. Users should consult the advisory for patch details.

The vulnerability allows attackers with low privileges and network access to compromise confidentiality by gaining unauthorized access to critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Additionally, attackers can perform unauthorized data modifications including updates, inserts, and deletions on some accessible data. There is no impact on system availability. This could lead to data breaches and unauthorized data manipulation within the affected system.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is applied, limit network exposure of the affected service and restrict access to trusted users only.