This vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (version 11.4.0) permits an unauthenticated attacker with network access over HTTP to compromise the system. Exploitation can lead to unauthorized access to critical or all accessible data within the affected Oracle Commerce components. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack requires no privileges or user interaction, has low complexity, and impacts confidentiality with a high severity score of 7.5. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability in the provided content.

Successful exploitation results in unauthorized access to critical or complete data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. There is no reported impact on integrity or availability. The vulnerability is remotely exploitable without authentication, increasing risk exposure.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively-supported product versions. Until a patch is confirmed and applied, restrict network access to the affected service to trusted users only.