This vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (version 11.4.0) enables a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to all accessible data within the product and can cause the application to hang or crash repeatedly, resulting in a complete denial of service. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality and availability. The vulnerability is associated with CWE-284 (Improper Access Control), CWE-400 (Uncontrolled Resource Consumption), and CWE-20 (Improper Input Validation). The vendor advisory linked does not explicitly confirm the availability of a patch or remediation level for this specific vulnerability.

An attacker with low privileges and network access can exploit this vulnerability to gain unauthorized access to sensitive data managed by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Additionally, the attacker can cause a denial of service by making the application hang or crash repeatedly. This results in a high impact on confidentiality and availability of the affected system. There is no indication that data integrity is affected.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly when available. Until a patch is confirmed and applied, restrict network access to the affected service where possible and monitor for unusual activity related to Oracle Commerce Guided Search / Experience Manager.