Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T21:17:58.540Z",
  "pubdate": "2026-08-18T21:17:58.540Z",
  "executiveSummary": "A critical security vulnerability affects the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically within the Endeca Application Controller component. This remotely exploitable vulnerability poses a severe risk to organizational infrastructure, carrying a maximum CVSS 3.1 base score of 9.8 out of 10.0. The flaw allows unauthenticated malicious actors to compromise the affected software entirely over a network via the HTTP protocol, requiring no user interaction or prior privileges for successful exploitation. Successful attacks lead to a complete system takeover, granting the adversary full control over the confidentiality, integrity, and availability of the underlying application data and processing resources. Given the ease of exploitation and the critical nature of the resulting impact, immediate remediation is imperative to secure vulnerable deployments of the supported version 11.4.0 against potential exploitation attempts.",
  "technicalDetails": "The vulnerability resides in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The architecture of the affected system exposes management or control interfaces over HTTP that fail to enforce adequate authentication and authorization boundaries. Consequently, an unauthenticated remote attacker can interact directly with the vulnerable service across a network boundary without needing any valid credentials or user-assisted interaction.\nThe attack vector relies on sending crafted HTTP requests to the exposed Endeca Application Controller endpoints. Because the application improperly validates or restricts incoming command and control instructions, the attacker can inject malicious payloads or execute arbitrary administrative commands directly within the context of the application runtime. This bypasses all intended security controls designed to restrict access to authorized administrators.\nThe step-by-step attack flow proceeds as follows: First, the attacker performs network reconnaissance to locate the exposed Oracle Commerce Guided Search / Oracle Commerce Experience Manager instance listening on the designated HTTP ports. Second, leveraging the lack of authentication (Privileges Required: None, Attack Complexity: Low), the adversary transmits a malicious HTTP request targeting the vulnerable Endeca Application Controller component. Third, the application processes the unvalidated input, resulting in arbitrary execution or unauthorized state changes. Finally, the adversary achieves complete system takeover, granting them the ability to exfiltrate confidential data, modify application integrity, and disrupt availability across the compromised environment."
}