This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is an easily exploitable network vulnerability that requires no privileges or user interaction, allowing an unauthenticated attacker to gain unauthorized access and perform critical data operations such as creation, deletion, or modification. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory from Oracle (July 2026 Critical Patch Update) includes this vulnerability in its list but does not explicitly state a remediation level or patch availability for this specific product version. Oracle strongly recommends applying available patches from the Critical Patch Update to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. This compromises confidentiality and integrity of all accessible data in the affected product version. There is no reported impact on availability. The vulnerability is remotely exploitable without authentication, increasing risk severity.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others and strongly recommends that customers apply security patches without delay. Although no explicit patch or remediation level is stated for this specific vulnerability in the advisory, users of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should monitor Oracle's security alerts and apply any relevant patches promptly once available. Until a patch is confirmed, restrict network access to the affected service where possible to reduce exposure.