This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits an unauthenticated attacker with network access over HTTP to compromise the product, requiring user interaction from a third party. Exploitation can result in unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and low confidentiality and integrity impacts without availability impact. The vulnerability is tracked as CWE-284 (Improper Access Control).

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The attack requires user interaction from a person other than the attacker and may affect additional Oracle Commerce products due to scope change. There is no reported impact on availability. The CVSS score of 6.1 reflects medium severity with confidentiality and integrity impacts.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, patching is the recommended remediation. Check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.