This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely without authentication over HTTP, enabling attackers to gain unauthorized read and write access to certain data within the product. Additionally, attackers can cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products including this one.

Successful exploitation can lead to unauthorized reading, updating, inserting, or deleting of some accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. It can also cause a partial denial of service, impacting availability. The vulnerability does not require authentication and can be exploited remotely over HTTP, increasing the risk of compromise.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should apply the patch without delay to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to prevent exploitation.