This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits an unauthenticated attacker who has logon access to the underlying infrastructure to compromise the product. Exploitation requires user interaction from a third party. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that the attack vector is local, attack complexity is low, no privileges are required, but user interaction is needed, and the impact on confidentiality, integrity, and availability is high. The vulnerability is tracked as CWE-284 (Improper Access Control).

An attacker with local access to the infrastructure and no privileges can exploit this vulnerability if a user interacts with the attack vector. Successful exploitation can result in complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, compromising confidentiality, integrity, and availability of the system.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory does not indicate that no action is required or that the issue is already mitigated without patching. Therefore, applying the official Oracle patch for version 11.4.0 is the recommended remediation.