This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. An unauthenticated attacker with network access via TLS can exploit this difficult-to-exploit vulnerability to cause the product to hang or crash repeatedly, resulting in a complete denial of service. Additionally, the attacker can gain unauthorized read access to a subset of accessible data within the product. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation can lead to a denial of service condition causing the Oracle Commerce Guided Search / Experience Manager to hang or crash repeatedly, disrupting service availability. It also allows unauthorized read access to some data within the affected product, impacting confidentiality to a limited extent. There is no impact on data integrity.

Oracle has released a Critical Security Patch Update that includes fixes for this vulnerability. Customers are strongly advised to apply the relevant security patches promptly to mitigate this issue. The affected version is 11.4.0, and patch availability details can be found in Oracle's September 2026 Critical Security Patch Update advisory. No indication was given that no action is required or that the vulnerability is already mitigated without patching.