This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It is easily exploitable by an attacker with low privileges and network access over HTTP, but requires user interaction from someone other than the attacker. The scope of impact may extend beyond the immediate product. The CVSS 3.1 base score is 7.6, reflecting high confidentiality impact and low integrity impact. The attack vector is network-based with low attack complexity, requiring privileges and user interaction. The vulnerability is tracked as CWE-284 (Improper Access Control).

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. It also allows unauthorized update, insert, or delete operations on some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that includes security fixes for this vulnerability. Customers are strongly advised to apply the relevant patches promptly. The vendor advisory emphasizes the importance of staying on actively supported versions and applying security patches without delay to prevent exploitation. No specific workaround or temporary fix is mentioned; patching is the recommended remediation.