This vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (version 11.4.0) permits an unauthenticated attacker with network access over HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network attack vector with low attack complexity, no privileges or user interaction required, and a high confidentiality impact. The vendor advisory from Oracle does not explicitly confirm the availability of a patch or fix for this specific vulnerability as of the July 2026 Critical Patch Update advisory. The vulnerability is categorized under CWE-284 (Improper Access Control).

Successful exploitation leads to unauthorized access to critical data or complete access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. There is no impact on integrity or availability reported. The vulnerability can be exploited remotely without authentication, increasing the risk of data compromise.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is released, restrict network access to the affected service where possible to limit exposure.