This vulnerability affects Oracle Commerce Guided Search Platform Services version 11.4.0. It is easily exploitable by unauthenticated attackers over the network via HTTPS. Exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the platform services. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. The vendor advisory from Oracle (https://www.oracle.com/security-alerts/cpujul2026.html) lists this vulnerability among others addressed in the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

An attacker can remotely and without authentication exploit this vulnerability to gain unauthorized access to critical data and perform unauthorized data creation, deletion, or modification within Oracle Commerce Guided Search Platform Services 11.4.0. This compromises the confidentiality and integrity of the data managed by the platform services. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

The vendor advisory references the July 2026 Critical Patch Update, which typically includes patches for vulnerabilities such as this. However, no explicit patch or remediation status is provided for this specific vulnerability in the advisory content. Therefore, patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions to mitigate exploitation risks.