This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. It is an easily exploitable flaw that permits unauthenticated attackers with network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) highlights that the attack requires no privileges or user interaction and impacts confidentiality with high severity. The vendor advisory from Oracle confirms the vulnerability and includes this product in their August 2026 Critical Security Patch Update. However, no explicit patch link or fixed version is provided in the input data.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This compromises confidentiality but does not affect integrity or availability. The vulnerability is remotely exploitable without authentication, increasing risk exposure.

Oracle has included this vulnerability in their August 2026 Critical Security Patch Update advisory. Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. Since no explicit patch link or fixed version is provided in the input, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions. Remaining on actively supported versions and applying Oracle patches without delay is critical to mitigate this vulnerability.