This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. An unauthenticated attacker with logon access to the infrastructure where the product runs can exploit this flaw, but exploitation requires human interaction from someone other than the attacker. The CVSS 3.1 base score is 7.8, indicating high impact on confidentiality, integrity, and availability. The vulnerability is documented in Oracle's Critical Security Patch Update advisory for September 2026, which includes patches for this and many other vulnerabilities.

Successful exploitation can result in complete takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, impacting confidentiality, integrity, and availability of the system. The attack requires the attacker to have logon access to the infrastructure and involves human interaction from a third party, which limits the attack vector but still poses a significant risk.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches without delay. The vendor advisory confirms that patches are available for Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. No indication is given that the vulnerability is already mitigated or requires no action.