This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially resulting in takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous fixes across many products including this one.

Successful exploitation can lead to complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, affecting confidentiality, integrity, and availability of the system. This could allow attackers to control the affected product remotely without authentication.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches promptly to mitigate this risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory indicating availability of fixes in the September 2026 update.