This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits an unauthenticated attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory references a Critical Security Patch Update from August 2026 but does not explicitly confirm a patch for this specific vulnerability in the provided content.

Successful exploitation can lead to complete compromise of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product.

Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. The vendor advisory references the August 2026 Critical Security Patch Update, which includes numerous fixes across Oracle products. However, the specific patch status for this vulnerability is not explicitly confirmed in the advisory content provided. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions.