This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits an unauthenticated attacker with network access via RMI to compromise the product, leading to unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack can be performed remotely with low complexity, no privileges, and no user interaction, resulting in a high confidentiality impact but no integrity or availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update references this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue. The advisory strongly recommends applying security patches promptly but does not list a specific patch for this product/version in the provided content.

Successful exploitation allows an unauthenticated remote attacker to access critical or all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This compromises confidentiality but does not affect integrity or availability. The vulnerability poses a high risk of unauthorized data disclosure.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Oracle recommends applying all relevant security patches without delay and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected service, especially RMI interfaces, to trusted networks only.