This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. An unauthenticated attacker with network access via HTTP can exploit this flaw, which is difficult to exploit, to gain unauthorized access to critical or all accessible data and cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, reflecting network attack vector, high attack complexity, no privileges or user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and cause a partial denial of service. The confidentiality impact is high, while availability impact is low. There is no impact on integrity. The vulnerability is difficult to exploit and requires network access via HTTP.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the available security patches promptly. Oracle recommends remaining on actively supported versions and applying security patches without delay. Check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. No indication was given that the vulnerability is already mitigated or requires no action.