This vulnerability affects Oracle Commerce Guided Search Platform Services (component: Forge) version 11.4.0. An attacker with low privileges and network access via HTTP can exploit this flaw to cause the service to hang or crash repeatedly, resulting in a complete denial of service. Additionally, the attacker can gain unauthorized read access to a subset of data accessible by the service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact. There is no explicit vendor advisory patch or remediation level stated in the advisory. The Oracle Critical Patch Update advisory referenced does not explicitly confirm a patch for this specific vulnerability, so patch status is not confirmed.

Successful exploitation can lead to unauthorized partial data disclosure (confidentiality impact) and a complete denial of service (availability impact) of Oracle Commerce Guided Search Platform Services version 11.4.0. This can disrupt service availability and expose some data to unauthorized users with low privileges over the network.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is confirmed and applied, consider restricting network access to the affected service to trusted users only to reduce exposure.