This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, specifically the Content Acquisition System component. It is exploitable remotely over HTTPS by unauthenticated attackers but is considered difficult to exploit. The impact includes unauthorized creation, deletion, or modification of critical data and unauthorized access to all accessible data within the affected product. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, high attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability among many others but does not explicitly confirm the availability of a patch or remediation for this specific issue. Oracle strongly recommends applying security patches promptly, but the advisory does not specify a fix for this version or vulnerability.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This compromises confidentiality and integrity of the system's data. There is no reported impact on availability. The vulnerability is rated high severity with a CVSS score of 7.4.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Until an official patch is confirmed, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the vulnerability is already mitigated.