This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0, specifically the Endeca Application Controller component. An unauthenticated attacker with network access via HTTP can exploit this flaw, but exploitation requires user interaction from a third party. Successful exploitation can result in unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to a subset of that data. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and limited confidentiality and integrity impacts without availability impact. No known exploits in the wild have been reported. Oracle has published a Critical Security Patch Update advisory but does not explicitly confirm a patch for this specific vulnerability in the provided content.

The vulnerability allows unauthorized actors to read and modify certain data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 without authentication, contingent on user interaction. This can compromise confidentiality and integrity of data within the affected product and potentially other Oracle products due to scope change. There is no impact on availability reported. The medium CVSS score reflects moderate risk.

Oracle recommends applying security patches promptly as part of their Critical Security Patch Update program. Although the vendor advisory lists a broad set of patched products, it does not explicitly confirm a patch for this specific vulnerability in the provided content. Users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until a patch is applied, users should be aware that exploitation requires user interaction, which may reduce risk. No vendor advisory states that no action is required or that the issue is already mitigated.