This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It is difficult to exploit but allows a low privileged attacker who has logon access to the infrastructure to compromise the product. The vulnerability has a scope change, meaning successful exploitation may impact additional Oracle products beyond the initially affected component. The CVSS 3.1 vector indicates local attack vector with high attack complexity, requiring low privileges and no user interaction, with a scope change and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, with significant confidentiality, integrity, and availability impacts. Due to scope change, other Oracle products may also be affected indirectly. The vulnerability requires local access with low privileges but is considered difficult to exploit.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the available security patches promptly. Oracle recommends remaining on actively supported versions and applying patches without delay to mitigate exploitation risks. No additional mitigation steps are indicated beyond applying the official patch.