This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It requires an attacker to have access to the physical communication segment connected to the hardware where the product executes. The vulnerability allows unauthorized access to critical data, limited unauthorized data modification (insert, update, delete), and the ability to cause a denial of service by hanging or crashing the application. The CVSS vector indicates the attack vector is adjacent network (AV:A), with high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality (high), integrity (low), and availability (high).

An attacker with physical network segment access can gain unauthorized access to critical data and partially modify data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Additionally, the attacker can cause denial of service conditions by hanging or crashing the application, impacting availability. The integrity impact is limited, but confidentiality and availability impacts are high.

Oracle has included this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay to prevent exploitation. No specific workaround or temporary fix is mentioned; applying the official patch is the recommended mitigation.