This vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0 enables a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data and partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update advisory.

The vulnerability allows unauthorized access to critical or all accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and enables an attacker to cause a partial denial of service. This compromises confidentiality and availability of the affected system. There is no reported impact on integrity. No known exploits in the wild have been reported at this time.

Oracle has released a security patch addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers running Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should apply the provided patch without delay to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation.