This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable by a high privileged attacker with network access over HTTP. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by the product. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope change, high confidentiality impact, and no integrity or availability impact. The vulnerability may also affect additional Oracle Commerce products due to scope change. There is no explicit patch link provided in the input data. The vendor advisory emphasizes applying security patches promptly but does not explicitly confirm a patch for this specific vulnerability in the provided content.

An attacker with high privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or complete access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. The vulnerability impacts confidentiality significantly but does not affect integrity or availability. The scope change indicates potential impact on additional Oracle Commerce products beyond the initially affected component.

Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. However, the provided vendor advisory content does not explicitly confirm the availability of a patch for CVE-2026-71008. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Until a patch is applied, limit network access to the affected product to trusted users with high privileges.