This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It is easily exploitable by unauthenticated attackers over HTTP, enabling them to compromise the system and perform unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and integrity impacts. The vendor advisory confirms the vulnerability and recommends applying security patches as part of Oracle's Critical Security Patch Update program.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. This compromises confidentiality and integrity of the system's data, potentially leading to significant operational and business impact.

Oracle has released security patches addressing this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. The vendor advisory emphasizes remaining on actively supported versions and promptly applying security updates to mitigate exploitation risks.