This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits an unauthenticated attacker with network access over HTTP to compromise the product, potentially leading to unauthorized access to all accessible data and the ability to cause a hang or repeated crash resulting in a complete denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and availability impacts but no integrity impact.

Successful exploitation can result in unauthorized access to critical or all accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and the ability to cause a hang or frequent crashes leading to a complete denial of service. This compromises confidentiality and availability of the affected system.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes remaining on actively supported versions and applying patches without delay. Patch availability details should be checked in the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No indication of no-action-required or prior mitigation is stated.