This vulnerability affects Oracle Commerce Guided Search Platform Services, specifically version 11.4.0. It is easily exploitable by unauthenticated attackers over the network via HTTP. Successful exploitation can lead to full compromise and takeover of the affected service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the impact is high across confidentiality, integrity, and availability. The vulnerability relates to authentication and authorization weaknesses (CWE-306, CWE-287, CWE-269). No explicit patch or remediation level is stated in the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory references multiple patches and strongly recommends applying updates promptly. The affected version is explicitly 11.4.0.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to take over Oracle Commerce Guided Search Platform Services version 11.4.0. This results in complete compromise of confidentiality, integrity, and availability of the service, potentially allowing full control over the affected system.

The vendor advisory does not explicitly confirm the availability of a patch for this specific vulnerability but references the July 2026 Critical Patch Update which includes numerous security patches. Oracle strongly recommends customers apply security patches without delay and remain on actively-supported versions. Users of Oracle Commerce Guided Search Platform Services version 11.4.0 should consult the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Patch status is not yet confirmed explicitly for this vulnerability; therefore, checking the vendor advisory for current remediation guidance is essential.