This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable by a low privileged attacker over the network via HTTP and can lead to unauthorized access to critical data or full access to all data accessible by the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no integrity or availability impact. The vulnerability may also impact additional Oracle Commerce products due to scope change. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes including this issue.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability affects confidentiality but does not impact integrity or availability. Due to scope change, other Oracle Commerce products may also be significantly impacted by attacks leveraging this vulnerability.

Oracle has released a fix for this vulnerability in the September 2026 Critical Security Patch Update (CSPU). Users of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should apply the security patches provided in this update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks.