This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable by an attacker with low privileges and network access over HTTP. Successful exploitation can lead to unauthorized access to critical or all accessible data and partial denial of service conditions. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory but no specific patch link for this product version was provided in the input data.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all accessible data in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. Additionally, the attacker can cause a partial denial of service affecting availability. This compromises confidentiality and availability of the affected system.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. Customers are strongly recommended to apply the relevant security patches promptly to remediate this vulnerability. Since no explicit patch link was provided in the input data, users should consult the official Oracle Critical Security Patch Update documentation at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Remaining on actively supported versions and applying security patches without delay is advised.