This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, specifically the Forge component. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially leading to full takeover. Successful exploitation requires user interaction from a person other than the attacker. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple Oracle products.

Successful exploitation can result in complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, impacting confidentiality, integrity, and availability of the system. The attack requires network access and user interaction, making exploitation more difficult but still possible. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Staying on actively supported versions and applying Oracle patches without delay is recommended. No additional vendor advisory states that no action is required or that the vulnerability is already mitigated without patching.