This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. Exploitation requires user interaction from a person other than the attacker, and the vulnerability's scope may extend to additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and limited confidentiality and integrity impacts without availability impact.

Successful exploitation can result in unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability's scope change means it may affect additional Oracle products beyond the initially targeted component. There is no reported impact on availability. The CVSS score of 6.1 corresponds to a medium severity impact primarily affecting confidentiality and integrity.

Oracle has released this information as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of remaining on actively supported versions and applying patches without delay. Since no specific patch link was provided in the input, users should consult the official Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.