This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable by a low privileged attacker over the network via HTTP without user interaction. Successful exploitation can lead to unauthorized access to critical or all accessible data within the affected product and can cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

The vulnerability allows unauthorized access to critical or all accessible data in Oracle Commerce Guided Search / Oracle Commerce Experience Manager and can cause a partial denial of service. This compromises confidentiality and availability of the affected system. There is no indication of integrity impact. No known exploits in the wild have been reported.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly. Oracle recommends staying on actively supported versions and applying security patches without delay to mitigate this vulnerability. Patch availability details should be confirmed from the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.