Threats tagged 'ghsa-jh24-8vm2-xhq3'

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, specifically in the Endeca Application Controller component. This vulnerability allows an unauthenticated attacker with access to the infrastructure where the product runs to potentially take over the application. Exploitation requires user interaction by a person other than the attacker. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 addressing this and many other vulnerabilities.