This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. It is a difficult to exploit flaw that requires the attacker to have low privileged logon access to the infrastructure where the product runs. Successful exploitation can lead to full compromise of the Oracle Commerce Guided Search / Experience Manager component. The CVSS vector indicates the attack requires local access (AV:L), high attack complexity (AC:H), low privileges (PR:L), no user interaction (UI:N), and results in high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).

If exploited, this vulnerability can result in complete takeover of the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component, affecting confidentiality, integrity, and availability of the system. However, exploitation is difficult and requires the attacker to have low privileged logon access to the infrastructure.

Oracle has released this information as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. The vendor advisory does not explicitly state the patch availability for this specific CVE but recommends applying all security patches from the Critical Security Patch Update. Patch status is not yet confirmed for this specific vulnerability; check the Oracle advisory for current remediation guidance.