This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely without authentication over HTTP but requires user interaction from a third party. Exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data within the product. The scope of impact may extend beyond the immediate product to other Oracle Commerce components. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update advisory, which provides patches for multiple products including this one.

An unauthenticated attacker with network access can exploit this vulnerability via HTTP, but successful exploitation requires user interaction from a person other than the attacker. The impact includes unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data accessible through Oracle Commerce Guided Search / Experience Manager. The vulnerability also causes a scope change, potentially affecting additional Oracle Commerce products beyond the initially vulnerable component.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. The affected version is 11.4.0, and applying the official patch is the recommended remediation. No indication was given that the vulnerability is already mitigated or requires no action. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and installation instructions.