This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. An unauthenticated attacker with network access via HTTP can exploit this flaw to access sensitive data or cause a complete denial of service by repeatedly crashing or hanging the application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, resulting in high confidentiality and availability impact.

Successful exploitation can lead to unauthorized access to all data accessible by Oracle Commerce Guided Search / Experience Manager, compromising confidentiality. Additionally, the attacker can cause a complete denial of service by hanging or crashing the application, impacting availability. There is no integrity impact reported. No known exploits in the wild have been reported.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly. The vendor advisory emphasizes the importance of applying available patches without delay to prevent exploitation. No specific workaround or temporary fix is mentioned, so patching is the primary mitigation.