This vulnerability affects Oracle Commerce Guided Search Platform Services version 11.4.0 and permits an unauthenticated attacker with network access over HTTP to compromise the service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can be performed remotely with low complexity. Successful exploitation can lead to full takeover of the affected service. Oracle has published this vulnerability in its July 2026 Critical Patch Update advisory, which addresses numerous vulnerabilities across many Oracle products, including Oracle Commerce Guided Search Platform Services. The advisory recommends applying patches promptly but does not explicitly confirm patch availability or a fix for this specific version in the provided content.

The vulnerability allows complete compromise of Oracle Commerce Guided Search Platform Services 11.4.0 by an unauthenticated remote attacker via HTTP. This includes full loss of confidentiality, integrity, and availability of the affected service, potentially enabling service takeover.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory and strongly recommends applying security patches without delay. However, the provided advisory content does not explicitly confirm the availability of a patch for Oracle Commerce Guided Search Platform Services version 11.4.0. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, restrict network access to the affected service where possible and monitor for suspicious activity.