This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits an unauthenticated attacker with network access over HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. Oracle has published this vulnerability in its July 2026 Critical Patch Update advisory but has not explicitly stated the availability of a patch or fix for this specific vulnerability within the advisory content provided.

Successful exploitation can lead to complete compromise of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or provide specific remediation instructions for this vulnerability. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant updates promptly. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected service where possible and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.