This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is an easily exploitable issue that permits unauthenticated attackers with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack can be performed remotely without authentication or user interaction, impacting confidentiality but not integrity or availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm the availability of a patch or remediation level for this specific issue. Customers are advised to consult the vendor advisory for patch availability and apply updates promptly.

Successful exploitation leads to unauthorized access to critical or all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. The confidentiality of sensitive information is severely impacted, but there is no direct impact on integrity or availability according to the CVSS vector. This could result in data breaches or exposure of sensitive business information.

Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state the availability of a patch or remediation for version 11.4.0. Customers should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updates on patch availability. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, no specific workaround or temporary fix is documented by the vendor.