This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It is exploitable by an attacker with low privileges who has logon access to the infrastructure where the product runs. Successful exploitation can lead to complete compromise of the affected Oracle Commerce components. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for this version in the input data.

An attacker with low privileges and logon access to the infrastructure can fully compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This results in complete loss of confidentiality, integrity, and availability of the affected product, effectively allowing takeover of the system.

Oracle recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory includes this vulnerability among others. However, no explicit patch link or fixed version is provided in the input data. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until a patch is applied, restrict access to the infrastructure hosting the affected product to trusted users only.