This vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It permits an unauthenticated attacker with network access over HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 base score is 8.1, indicating high impact on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly state a patch or remediation for this vulnerability, leaving patch status unconfirmed.

Successful exploitation can lead to complete compromise of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take control of the affected product, potentially disrupting business operations and exposing sensitive data.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory and subsequent updates for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to the affected service where possible to reduce exposure.