This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable by an attacker with low privileges and network access over HTTP, allowing compromise of the product and unauthorized access to critical or complete data within Oracle Commerce Guided Search / Experience Manager. The vulnerability also has a scope change impact, potentially affecting additional Oracle Commerce products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no impact on integrity or availability. Oracle’s September 2026 Critical Security Patch Update includes a fix for this vulnerability, and Oracle strongly recommends applying this patch promptly.

Successful exploitation can lead to unauthorized access to critical or complete data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability’s scope change means it may also impact additional Oracle Commerce products. The confidentiality impact is high, but there is no direct impact on integrity or availability. This could result in significant data exposure within affected environments.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the patch without delay to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.