This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. It is difficult to exploit and requires the attacker to have low privileged logon access to the infrastructure where the product runs. Successful exploitation can lead to full compromise of the Oracle Commerce Guided Search / Experience Manager. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security fixes for this and many other vulnerabilities.

If exploited, this vulnerability can result in complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, impacting confidentiality, integrity, and availability of the system. The attacker must have low privileged logon access to the infrastructure, and the attack complexity is high, making exploitation difficult but possible. There are no known exploits in the wild at this time.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers should apply the relevant patches from this update promptly to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.