This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable by a high privileged attacker over the network via HTTP, allowing compromise of the product and unauthorized access to critical data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high confidentiality impact with no integrity or availability impact. The vulnerability is part of Oracle's August 2026 Critical Security Patch Update, which provides targeted security fixes. Oracle strongly recommends applying the available patches to mitigate this vulnerability.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability affects confidentiality but does not impact integrity or availability. The scope change indicates that additional Oracle Commerce products may be impacted by attacks leveraging this vulnerability.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official Oracle patches without delay to remediate the issue. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches. No alternative mitigations or temporary fixes are indicated in the advisory.