This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. It is easily exploitable by an attacker with low privileges and network access over HTTP. Successful exploitation can lead to unauthorized access to sensitive or all accessible data within the affected product and can also cause a partial denial of service condition. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability was disclosed in a Critical Security Patch Update by Oracle in September 2026.

An attacker with low privileges and network access can exploit this vulnerability to gain unauthorized access to critical or all accessible data in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Additionally, the attacker can cause a partial denial of service, impacting availability. There is no reported impact on data integrity. The vulnerability poses a high risk due to the potential exposure of sensitive data and service disruption.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Users of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 are strongly advised to apply the relevant security patches provided by Oracle without delay. Oracle recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks. Patch status is confirmed by the vendor advisory indicating availability of fixes in the Critical Security Patch Update.