This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely by an unauthenticated attacker over HTTP but is considered difficult to exploit. Successful exploitation can lead to unauthorized access to critical or all accessible data within the affected product and can also cause a partial denial of service. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security fixes across multiple products.

The vulnerability allows unauthorized access to sensitive data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and can cause partial denial of service conditions. Confidentiality is highly impacted, while availability impact is low. There is no integrity impact. The attack requires network access via HTTP and is difficult to exploit, with no privileges or user interaction required.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the Oracle Critical Security Patch Update advisory. No alternative mitigations are specified.