This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Workbench) version 11.4.0. It is exploitable by an attacker with low privileges and network access over HTTP, requiring human interaction from a user other than the attacker. The vulnerability can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some accessible data. The CVSS 3.1 base score is 7.6 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data accessible through Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability affects confidentiality and integrity, potentially impacting additional products due to scope change. Availability is not impacted.

Oracle has released security patches addressing this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. No indication that the vulnerability is already mitigated or requires no action was provided. Patch status is confirmed by the vendor advisory. The affected version is 11.4.0, so upgrading or patching this version is recommended.