This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It permits an unauthenticated attacker with network access via TCP to compromise the product, potentially resulting in complete takeover. The CVSS 3.1 base score is 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security fixes across many products including this one.

Successful exploitation can lead to full compromise of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product completely.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory indicating that a fix is available in the September 2026 Critical Security Patch Update.