This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0, specifically the Endeca Application Controller component. It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized modification of critical data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects that the attack requires no privileges or user interaction and impacts data integrity severely. Oracle's advisory references this vulnerability within a broad Critical Security Patch Update but does not detail a dedicated patch for version 11.4.0 in the excerpt provided.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This compromises data integrity but does not affect confidentiality or availability according to the CVSS vector. The vulnerability can be exploited remotely without authentication, increasing the risk to affected deployments.

Oracle's August 2026 Critical Security Patch Update advisory recommends applying security patches promptly and remaining on actively supported versions. However, the provided data does not explicitly confirm the availability of a patch for Oracle Commerce Guided Search / Experience Manager 11.4.0. Organizations should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch status and apply any relevant updates without delay. Until a patch is confirmed, restrict network access to the affected service where possible.