This vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0 allows a low privileged attacker with logon access to the infrastructure to compromise the product. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all accessible data within the product. The CVSS 3.1 base score is 7.1, reflecting high confidentiality and integrity impacts with low attack vector (local), low attack complexity, and no user interaction required. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not provide a specific patch or remediation level for it yet.

The vulnerability enables unauthorized creation, deletion, or modification of critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This compromises the confidentiality and integrity of data accessible by the product. There is no impact on availability. The attacker requires low privileges and local access to the infrastructure where the product runs.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is released, restrict local access to the infrastructure and monitor for unauthorized activity related to Oracle Commerce Guided Search / Experience Manager.