This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is easily exploitable by a low privileged attacker with network access via HTTP. Successful exploitation can lead to unauthorized access to critical or all accessible data within the product and can cause a hang or frequent crashes resulting in a complete denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch for this specific vulnerability but strongly recommends applying available patches without delay. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all accessible data in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. The attacker can also cause the application to hang or crash repeatedly, resulting in a denial of service. This impacts confidentiality and availability of the affected system.

Patch status is not yet confirmed—check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches promptly to mitigate this and other vulnerabilities. No vendor advisory states that no action is required or that the issue is already mitigated.