This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. An attacker with low privileges and logon access to the infrastructure where the product runs can exploit this flaw to compromise the product and access sensitive data. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without affecting integrity or availability.

Successful exploitation results in unauthorized access to critical or all data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. There is no reported impact on data integrity or system availability. The vulnerability requires the attacker to have logon access to the infrastructure, limiting remote exploitation possibilities.

Oracle has released security patches as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this vulnerability. Staying on actively supported versions and applying Oracle's security updates without delay is recommended. Patch availability is documented in Oracle's advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or workarounds are specified.