This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. It is a network-accessible vulnerability exploitable without authentication but requires high attack complexity. Successful exploitation can result in complete takeover of the affected product, impacting confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-70980 with a CVSS 3.1 base score of 9.0. Oracle has published an advisory as part of its August 2026 Critical Security Patch Update, which includes this and many other fixes.

Successful exploitation can lead to full compromise of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, including unauthorized access and control. The vulnerability affects confidentiality, integrity, and availability, potentially allowing attackers to take over the affected system. Additionally, the attack scope may extend to other Oracle products, increasing the potential impact.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. Oracle recommends staying on actively supported versions and applying security updates without delay. Patch status is confirmed by the vendor advisory; no alternative mitigations are indicated.