This vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (version 11.4.0) permits an attacker with low privileges and network access over HTTP to compromise the product by gaining unauthorized ability to update, insert, or delete some accessible data, as well as read unauthorized subsets of data. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impacts on confidentiality and integrity but not availability. The vendor advisory references a Critical Patch Update containing numerous patches but does not explicitly confirm a fix for this vulnerability in the provided text.

Successful exploitation allows unauthorized read access to some data and unauthorized modification (update, insert, delete) of some accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This compromises confidentiality and integrity of the affected data. Availability is not impacted. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly. Until a patch is confirmed and applied, restrict network access to the affected service where possible to limit exposure.