This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits a low privileged attacker with network access over HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vendor advisory from Oracle confirms the affected version and recommends applying security patches as part of their August 2026 Critical Security Patch Update. No explicit patch link for this specific vulnerability was provided, but Oracle strongly recommends applying available patches promptly.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. There is no reported impact on data integrity or availability. The vulnerability is exploitable remotely over HTTP by an attacker with low privileges, increasing the risk of data confidentiality breaches.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Customers are strongly advised to remain on actively supported versions and apply the relevant security patches without delay. Since this is not a cloud service, patching must be performed by the customer. Check Oracle's official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.