This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It is easily exploitable by an attacker with low privileges and network access via HTTP, but requires human interaction from a person other than the attacker. The vulnerability can result in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly state a dedicated patch for version 11.4.0 of this product in the provided excerpt.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager, as well as unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity, with no impact on availability. The scope of the impact extends beyond the immediate product to additional Oracle Commerce products due to scope change.

Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability in its list of addressed issues. However, no explicit patch availability for Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 is confirmed in the provided advisory content. Customers are strongly recommended to remain on actively-supported versions and apply Oracle security patches promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.