This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is an easily exploitable network vulnerability that requires no privileges but does require user interaction. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 base score of 9.3, indicating critical severity. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data and full access to all data accessible by the affected product. The vulnerability has a scope change, meaning it may affect additional Oracle Commerce products beyond the initially targeted component.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. The attacker can also gain complete access to all accessible data in the affected product. This compromises confidentiality and integrity but does not impact availability. The vulnerability's scope change indicates potential impact on other Oracle Commerce products.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches without delay to mitigate this vulnerability. The vendor advisory does not indicate that no action is required or that the issue is already mitigated. Therefore, applying the official Oracle patch for version 11.4.0 is the recommended remediation. Patch status is confirmed by the Oracle advisory linked in the input.