This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely over HTTP by unauthenticated attackers due to insufficient access controls (CWE-284). Successful exploitation can lead to unauthorized access to critical or all accessible data within the affected product. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability impact. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory, which includes patches for this and many other vulnerabilities.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to sensitive or all accessible data in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This compromises confidentiality but does not affect integrity or availability. The impact is significant as it allows data exposure without authentication.

Oracle has addressed this vulnerability in their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. Staying on actively supported versions and applying Oracle patches without delay is recommended. No alternative mitigations or workarounds are specified in the advisory.