This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It permits an unauthenticated attacker with network access via HTTP to compromise the system, contingent on user interaction by a third party. The vulnerability can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, required user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's advisory is part of the August 2026 Critical Security Patch Update, which includes a large number of security fixes across multiple products. The vendor strongly recommends applying patches promptly to mitigate exploitation risks.

Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability affects confidentiality and integrity with high impact on confidentiality and low impact on integrity. There is no impact on availability. The scope of the vulnerability extends beyond the immediate product, potentially affecting additional Oracle Commerce products.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers should apply the relevant patches for Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. Patch availability details are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or workarounds are specified.