This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. It is an easily exploitable flaw that permits unauthenticated remote attackers to compromise the product over HTTP. Successful exploitation can lead to full system takeover, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on all security properties. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability among many others but does not explicitly confirm patch availability or remediation details for this specific issue.

An unauthenticated attacker with network access via HTTP can fully compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This results in complete loss of confidentiality, integrity, and availability of the affected system, effectively allowing an attacker to take over the product.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected service to trusted users only and monitor for suspicious activity related to Oracle Commerce Guided Search / Experience Manager.