This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is easily exploitable by unauthenticated attackers over the network via HTTP. Successful exploitation can cause the service to hang or crash repeatedly, resulting in a complete denial of service. Additionally, attackers can gain unauthorized read access to a subset of data accessible by the affected product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across various products. Customers are strongly advised to apply the available patches promptly.

An unauthenticated attacker with network access can exploit this vulnerability to cause a denial of service by hanging or crashing Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The attacker can also gain unauthorized read access to some data within the affected product. This impacts confidentiality and availability but does not affect integrity. The vulnerability is rated high severity with a CVSS 3.1 score of 8.2.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers using Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should apply the relevant patch from this update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks.