This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It is easily exploitable by unauthenticated attackers over HTTP, enabling them to compromise and take over the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory references a Critical Patch Update released in July 2026 covering this and many other vulnerabilities, but does not explicitly confirm patch availability or remediation status for this specific CVE.

Successful exploitation allows an unauthenticated remote attacker to fully compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0, resulting in complete takeover of the system. This impacts confidentiality, integrity, and availability of the affected product.

Patch status is not yet confirmed — check the Oracle Critical Patch Update July 2026 advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected service to trusted users only.