This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It is easily exploitable by unauthenticated attackers over HTTP and can result in unauthorized access to critical data or complete access to all accessible data within the product. Additionally, attackers may gain unauthorized update, insert, or delete capabilities on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability's scope change means it may impact other Oracle Commerce products beyond the initially affected component.

Successful exploitation can lead to unauthorized access to critical data and partial unauthorized modification of data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability affects confidentiality and integrity but does not impact availability. Due to scope change, additional Oracle Commerce products may also be significantly impacted.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.