This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely over HTTP without authentication but requires user interaction. Exploitation can result in unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and limited confidentiality and integrity impacts without availability impact.

Successful exploitation can lead to unauthorized modification and disclosure of data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond the initially vulnerable component. The confidentiality and integrity of some data can be compromised, but availability is not impacted. There are no known exploits in the wild at this time.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly. The vendor advisory does not specify a patch for this exact version separately but recommends applying the Critical Security Patch Update which addresses this and other vulnerabilities. No alternative mitigations or workarounds are indicated. Maintaining up-to-date patches is the primary remediation.