This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. Exploitation can lead to unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to some data. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and low confidentiality and integrity impacts.

Successful exploitation can result in unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability affects confidentiality and integrity but does not impact availability. Additionally, the scope change indicates that other Oracle products may be significantly impacted as a result of this vulnerability.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly. The vendor advisory does not indicate that no action is required or that the issue is already mitigated. Therefore, applying the official Oracle patches for version 11.4.0 is the recommended remediation.