This vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (version 11.4.0) allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. Oracle's advisory for the August 2026 Critical Security Patch Update includes this vulnerability among 943 fixes across multiple products.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. It compromises confidentiality and integrity of data accessible by the product, potentially allowing an attacker to fully control critical data. There is no reported impact on system availability. No known exploits in the wild have been reported to date.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. Customers are strongly advised to apply the relevant security patches promptly to remediate this vulnerability. Staying on actively supported versions and timely patching are critical to prevent exploitation. Patch availability details are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or workarounds are specified.