This vulnerability affects Oracle Commerce Guided Search Platform Services version 11.4.0 and is exploitable by a low privileged attacker over the network via HTTP. Successful exploitation can cause the service to hang or crash repeatedly, resulting in a complete denial of service (DoS). Additionally, it allows unauthorized read access to a subset of data accessible by the service. The CVSS 3.1 base score is 7.1, reflecting low confidentiality impact and high availability impact. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information) and CWE-400 (Uncontrolled Resource Consumption). The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this vulnerability.

Exploitation can lead to unauthorized disclosure of some data from Oracle Commerce Guided Search Platform Services and cause a complete denial of service by hanging or crashing the service. This impacts confidentiality (limited data exposure) and availability (service disruption), but does not affect data integrity. No known exploits in the wild have been reported.

Oracle's July 2026 Critical Patch Update advisory should be consulted for patch availability and installation instructions. The advisory strongly recommends applying security patches without delay to mitigate vulnerabilities. Since no explicit patch status for this vulnerability is stated, users should verify patch availability in the referenced advisory. Until patched, limit network access to the affected service where possible.