This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It is easily exploitable by unauthenticated attackers over the network via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data within the affected product. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

An attacker can gain unauthorized access to critical data or full access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This includes the ability to create, delete, or modify critical data, which could severely compromise the integrity and confidentiality of the system's data.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.