This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all accessible data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 security patches and urges customers to apply patches without delay.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. This compromises confidentiality and integrity of data but does not affect availability. The vulnerability is rated high severity with a CVSS 3.1 score of 7.4.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers running Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should apply the relevant security patches promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to mitigate this vulnerability.