This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. An unauthenticated attacker with network access via HTTP can exploit this flaw, which requires user interaction from a person other than the attacker. The scope of impact may extend to additional Oracle Commerce products. Exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The CVSS 3.1 base score is 8.2, reflecting high confidentiality and low integrity impacts with no availability impact.

Exploitation of this vulnerability can lead to unauthorized access to critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity, potentially compromising sensitive information and data integrity within the affected product environment.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of applying available patches without delay and remaining on actively supported versions. No alternative mitigations or workarounds are specified in the advisory.