This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 and is classified under Oracle Commerce's Forge component. It enables an unauthenticated attacker who has logon access to the infrastructure hosting the product to compromise it. Exploitation requires user interaction from someone other than the attacker. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that the attack requires local access with low complexity, no privileges, but user interaction, and results in high confidentiality, integrity, and availability impacts. Oracle has acknowledged this vulnerability in its September 2026 Critical Security Patch Update advisory, which includes patches addressing this and many other vulnerabilities across Oracle products. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can result in complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, impacting confidentiality, integrity, and availability of the system. The attack requires an unauthenticated attacker to have logon access to the infrastructure and involves user interaction from a third party. This can lead to unauthorized control and potential disruption of the affected Oracle Commerce components.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers using Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should apply the relevant patches from this update promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to mitigate exploitation risks. Patch status is confirmed by the vendor advisory indicating availability of fixes in the September 2026 Critical Security Patch Update.