This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is an easily exploitable flaw that permits unauthenticated attackers with network access through SOAP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, highlighting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. The vendor advisory references a Critical Security Patch Update from August 2026 but does not explicitly confirm patch availability for this specific vulnerability.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. There is no reported impact on data integrity or availability. The vulnerability is remotely exploitable without authentication, increasing risk exposure.

The Oracle advisory recommends applying security patches promptly and staying on actively supported versions. However, the advisory does not explicitly confirm a patch for CVE-2026-71034. Patch status is not yet confirmed—check the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Until a patch is confirmed and applied, restrict network access to SOAP interfaces where possible.