This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It is difficult to exploit but allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible data within the product, unauthorized update, insert, or delete operations on some data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality impact with lower integrity and availability impacts.

The impact includes unauthorized access to sensitive data, partial data modification capabilities, and partial denial of service conditions within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. This could compromise confidentiality significantly, with lesser but notable impacts on integrity and availability.

Oracle has released a Critical Security Patch Update (CSPU) that addresses this vulnerability. Customers are strongly advised to apply the relevant security patches promptly to mitigate the risk. The affected version is 11.4.0, and the patch availability and installation instructions are provided in Oracle's official advisory at https://www.oracle.com/security-alerts/cspusep2026.html. No indication was given that no action is required or that the issue is already mitigated without patching, so patch application is necessary.