This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits an unauthenticated attacker with network access via RMI to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory lists this vulnerability but does not explicitly confirm the availability of a patch or remediation level for this specific issue. Customers are advised to monitor Oracle advisories for patch releases.

Successful exploitation allows an unauthenticated remote attacker to access critical or all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This compromises confidentiality but does not affect integrity or availability. The vulnerability can lead to unauthorized data disclosure without requiring authentication or user interaction.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly once available and remaining on actively-supported versions. Until a patch is released, restrict network access to the affected service, especially RMI endpoints, to trusted users only.