This vulnerability affects Oracle Commerce Guided Search and Oracle Commerce Experience Manager version 11.4.0. It is easily exploitable by unauthenticated attackers over the network via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the affected Oracle Commerce components. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impact with no availability impact. The vendor advisory references a Critical Patch Update released in July 2026 but does not explicitly confirm a patch for this specific vulnerability in the provided content.

An attacker can remotely and without authentication compromise Oracle Commerce Guided Search / Experience Manager 11.4.0, gaining unauthorized ability to create, delete, or modify critical data, or access all data accessible by these components. This poses a significant risk to data confidentiality and integrity within affected deployments.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly. Until a patch is confirmed and applied, restrict network access to the affected services to trusted users only and monitor for suspicious activity related to Oracle Commerce Guided Search / Experience Manager.