This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It is easily exploitable by a low privileged attacker with network access over HTTP and requires user interaction from a person other than the attacker. Exploitation can result in unauthorized access to critical data or complete access to all accessible data within the product, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 base score is 7.6, reflecting high confidentiality impact and low integrity impact with no availability impact. The vulnerability has a scope change, potentially affecting additional products beyond the immediate target.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager, and unauthorized modification of some data. This compromises confidentiality and integrity of the affected system. There is no direct impact on availability. The vulnerability requires user interaction and network access, which may limit exploitation scenarios. No known exploits in the wild have been reported.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches promptly. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay. Since the affected version is 11.4.0, users should consult Oracle's August 2026 Critical Security Patch Update documentation for patch availability and installation instructions. No indication was given that the vulnerability is already mitigated or requires no action.