This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It permits an unauthenticated attacker with network access via TCP to compromise the product, potentially resulting in complete takeover. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. Oracle has acknowledged this vulnerability in its September 2026 Critical Security Patch Update advisory, which includes numerous security fixes across Oracle products, including this one.

Successful exploitation can lead to full compromise of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches without delay. Since the product is not a cloud service, patching must be performed by the customer. Patch status is confirmed by the vendor advisory recommending prompt application of patches. No indication of 'no action required' or 'already mitigated' is present.