CVE-2026-71024 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. It is an easily exploitable vulnerability that allows unauthenticated remote attackers to access sensitive data or cause partial denial of service via HTTP network access. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability is tracked under CWE-284 (Improper Access Control). Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly confirm a dedicated patch for this version in the provided content. Customers are urged to apply available patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and can cause a partial denial of service. This compromises confidentiality significantly and availability to a lesser extent. No integrity impact is indicated. There are no known exploits in the wild at this time.

Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability. Customers should apply the relevant patches promptly. Since the advisory does not explicitly confirm the patch availability status for version 11.4.0 of Oracle Commerce Guided Search / Experience Manager, users should consult the official Oracle patch availability documentation linked in the advisory for precise remediation steps. Maintaining up-to-date patched versions is strongly recommended to prevent exploitation.