This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It is easily exploitable by unauthenticated attackers over HTTP network access, allowing them to compromise the product and gain unauthorized access to critical or all accessible data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and high confidentiality impact. The vulnerability may also impact additional Oracle Commerce products due to scope change. Oracle has published a Critical Security Patch Update in August 2026 addressing this and many other vulnerabilities, strongly recommending patch application.

Successful exploitation results in unauthorized access to critical data or complete access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The confidentiality impact is high, while integrity and availability impacts are not affected. The vulnerability's scope change means it could affect other Oracle Commerce products beyond the initially identified component.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No indication of temporary or alternative mitigations is provided, so patching is the primary remediation.