This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It is exploitable by a low privileged attacker who has logon access to the infrastructure where the product runs. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible by the product. The CVSS 3.1 base score is 7.1, indicating high severity with high confidentiality and integrity impacts. The vulnerability does not impact availability. Oracle's July 2026 Critical Patch Update advisory lists this product and version among affected products but does not explicitly state patch availability or remediation details for this vulnerability.

An attacker with low privileges and logon access to the infrastructure can compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0, leading to unauthorized creation, deletion, or modification of critical or all accessible data. This results in a high impact on confidentiality and integrity of the data managed by the product. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or official remediation for this specific vulnerability. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, restricting logon access to the infrastructure hosting Oracle Commerce Guided Search / Oracle Commerce Experience Manager and monitoring for unauthorized activity are prudent measures. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.