This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized access to critical or all accessible data within the product. The vulnerability also allows the attacker to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities.

Successful exploitation can lead to unauthorized access to critical or all accessible data in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, compromising confidentiality. It also allows an attacker to cause a partial denial of service, impacting availability. There is no reported impact on data integrity. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should apply the provided patch without delay to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation.