This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data and unauthorized read access to some data. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, low confidentiality impact, high integrity impact, and no availability impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this and many other vulnerabilities. Customers are strongly advised to apply the available patches without delay to mitigate the risk.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager, as well as unauthorized read access to some data. The scope of impact may extend to additional Oracle Commerce products. The confidentiality impact is low, but the integrity impact is high, and availability is not affected. This can compromise the integrity of critical business data managed by the affected product.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should promptly apply the official patches provided by Oracle to remediate this issue. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.