This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. The vulnerability allows unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The scope of impact extends beyond the immediate product to additional Oracle products. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and low confidentiality and integrity impacts.

Exploitation can result in unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates potential impact on additional Oracle products beyond the immediate component.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly. The vendor advisory does not indicate that no action is required or that the issue is already mitigated without patching. Therefore, applying the official Oracle patches for version 11.4.0 is the recommended remediation. Patch status is confirmed by the vendor advisory indicating patch availability in the August 2026 CSPU.