This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely by an unauthenticated attacker with network access via TCP, though it is considered difficult to exploit. Successful exploitation can lead to full compromise of the affected product, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

If exploited, this vulnerability can result in complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, compromising confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive data, alter system operations, or disrupt service availability.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should apply the provided patch promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.