This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits a low privileged attacker with network access over HTTP to compromise the product, resulting in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and low confidentiality and integrity impacts without availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch or remediation for this specific vulnerability, and no known exploits have been reported in the wild.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This impacts confidentiality and integrity of the affected data but does not affect availability. The attacker requires low privileges and network access via HTTP to exploit this vulnerability.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory.