Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-18T21:17:58.657Z",
  "pubdate": "2026-08-18T21:17:58.657Z",
  "executiveSummary": "An unauthenticated remote vulnerability affecting the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically within the Endeca Application Controller component, presents significant risks to enterprise environments. The vulnerability allows unauthenticated attackers with network access via HTTP to remotely target the system without requiring user interaction or prior privileges.\nSuccessful exploitation of this flaw results in unauthorized access to critical data or complete compromise of all data accessible to Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Due to the architectural scope change associated with the vulnerability, successful attacks may also significantly impact additional integrated or peripheral products beyond the primary target.\nWith a CVSS 3.1 Base Score of 8.6, the risk profile is heavily weighted toward severe confidentiality impacts. The low attack complexity and lack of authentication requirements make this an easily exploitable flaw for network-adjacent or external threat actors capable of reaching the vulnerable HTTP services.\nOrganizations utilizing the affected version must prioritize defensive remediation by applying official vendor patches, restricting network exposure, enforcing strict perimeter controls, and monitoring for anomalous HTTP traffic directed at the Endeca Application Controller component.",
  "technicalDetails": "The vulnerability resides within the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The software fails to adequately validate or restrict incoming HTTP requests processed by the application controller, allowing unauthorized actors to bypass security boundaries.\nExploitation requires network access via HTTP. Because the vulnerability requires zero privileges and no user interaction, an unauthenticated attacker can directly interact with the exposed service endpoints of the Endeca Application Controller.\nThe attack flow begins when an external threat actor crafts a specialized HTTP request directed to the vulnerable Oracle Commerce Guided Search / Oracle Commerce Experience Manager instance. Due to insufficient input sanitization and access control enforcement within the Endeca Application Controller, the application processes the malicious payload.\nUpon successful payload execution, the attacker gains unauthorized read access to sensitive data repositories managed or accessible by the application. Furthermore, the vulnerability exhibits a scope change (S:C), meaning that a successful compromise of the primary component can cascade, resulting in significant security impacts to additional downstream or interconnected products and data stores within the enterprise architecture.\nThe root cause stems from improper authorization and boundary enforcement in the Endeca Application Controller, which fails to verify whether the entity issuing the HTTP request possesses the requisite privileges to query or retrieve critical data assets.\nPost-exploitation impact is characterized by a complete breach of data confidentiality. Attackers can harvest sensitive business logic data, customer records, or proprietary information accessible through the vulnerable Oracle Commerce Guided Search / Oracle Commerce Experience Manager interfaces, potentially leveraging compromised data for subsequent attacks against the broader infrastructure."
}