This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely over the network via HTTP by a low privileged attacker but requires user interaction from a third party. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 base score of 8.7. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by the product. The vulnerability has a scope change, potentially affecting additional Oracle Commerce products beyond the initially targeted component.

Exploitation of this vulnerability can lead to significant unauthorized access and modification of critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and potentially other Oracle Commerce products. Confidentiality and integrity impacts are high, but availability is not affected. This could compromise the integrity and confidentiality of sensitive commerce data.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of staying on actively supported versions and applying patches without delay. Patch availability is documented in the Oracle advisory linked in the source. No specific temporary mitigations are noted; applying the official patch is the recommended remediation.