Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:58.997Z",
  "pubdate": "2026-08-18T21:17:58.997Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, carrying a CVSS 3.1 Base Score of 8.1 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. This security flaw enables a low-privileged remote attacker with network access via HTTP to compromise the affected application, leading to severe impacts on both data confidentiality and data integrity. Successful exploitation grants the adversary unauthorized capabilities to create, modify, or delete critical data, as well as gain unauthorized access to sensitive application data accessible within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The risk implications are substantial, as compromised data integrity and confidentiality can lead to unauthorized manipulation of merchandising content, catalog data, or administrative configurations. The exploitation vector requires network connectivity and low privileges, meaning an authenticated user with minimal access rights can leverage this flaw to escalate their operational data manipulation and viewing capabilities beyond their authorized boundary without requiring user interaction.",
  "technicalDetails": "The vulnerability resides in the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. The root cause stems from insufficient access control enforcement and authorization checks within HTTP-based request handling mechanisms. Specifically, the application fails to adequately validate whether a low-privileged authenticated user possesses the necessary operational permissions to interact with or modify critical backend resources and data repositories.\nExploitation of this vulnerability occurs over the network via the HTTP protocol. An attacker begins by authenticating to the system with low privileges, establishing a baseline session. The attacker then crafts and transmits targeted HTTP requests directed at vulnerable endpoints within the Experience Manager component. Because the backend component lacks robust access validation, it improperly processes these requests, bypassing intended privilege boundaries.\nThe attack flow proceeds as follows: First, the low-privileged attacker identifies target functions or data objects within Oracle Commerce Guided Search / Oracle Commerce Experience Manager that are restricted or sensitive. Second, the attacker formulates an HTTP request leveraging predictable URI paths or API parameters associated with the Experience Manager component. Third, the application processes the request under the assumption of authorized access due to the missing authorization checks. Finally, the server executes the requested operations, granting the attacker unauthorized read access to critical data and enabling the unauthorized creation, modification, or deletion of protected data structures.\nThe post-exploitation impact is characterized by high confidentiality and high integrity breaches (C:H, I:H). An attacker can harvest sensitive business data or tamper with core merchandising rules and guided search configurations, thereby undermining the reliability and security of the entire e-commerce search and navigation framework. Availability impact remains none (A:N), as the flaw does not inherently cause denial-of-service conditions."
}