This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It allows unauthenticated remote attackers to exploit the system via HTTP, requiring user interaction from a third party. The vulnerability permits unauthorized update, insert, delete, and read access to some accessible data within the affected product. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and low confidentiality and integrity impacts with no availability impact. Oracle's advisory is part of the August 2026 Critical Security Patch Update, which includes patches for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can result in unauthorized read and write access to some data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability requires user interaction from a person other than the attacker and affects confidentiality and integrity but not availability. The scope change indicates that additional Oracle products may be impacted indirectly. There are no reports of active exploitation in the wild.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly. Since this is not a cloud service, patching must be performed by the customer. No additional mitigation steps are stated in the advisory. Patch status is confirmed by Oracle's official advisory.