Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-18T21:17:59.130Z",
  "pubdate": "2026-08-18T21:17:59.130Z",
  "executiveSummary": "An easily exploitable security vulnerability affects the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically within the Experience Manager component in version 11.4.0. This flaw permits a low-privileged threat actor with network access via HTTP to compromise the targeted system.\nSuccessful exploitation requires user interaction from an individual other than the attacker. Due to a scope change, successful attacks can significantly impact additional products beyond the primary vulnerable component.\nThe risk implications are severe, potentially resulting in unauthorized creation, deletion, or modification access to critical data and all data accessible within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Additionally, attackers can gain unauthorized read access to critical or complete data sets.\nThe severity of this vulnerability is underscored by a CVSS 3.1 Base Score of 8.7, driven by high confidentiality and integrity impacts, making prompt defensive evaluation critical for organizations utilizing the affected software version.",
  "technicalDetails": "The vulnerability resides in the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The attack surface is exposed over the network via the HTTP protocol, allowing remote interaction with the affected application interfaces.\nExploitation requires a low-privileged authenticated attacker to leverage network access. The attack vector mandates human interaction from a third party, suggesting an interaction-driven exploitation vector such as Cross-Site Scripting (XSS) or a manipulated workflow requiring victim participation.\nThe attack flow proceeds as follows: First, the low-privileged attacker crafts a malicious request or payload intended for the Experience Manager component. Second, the attacker induces a targeted user to perform a required interaction via HTTP, executing the payload within the context of the victim's session or permissions. Third, due to the scope change (S:C) property, the impact propagates beyond the immediate Oracle Commerce Guided Search / Oracle Commerce Experience Manager boundary to affect supplementary integrated products.\nPost-exploitation impacts include comprehensive confidentiality and integrity breaches. An unauthorized actor can achieve unauthorized access to critical or complete data sets, alongside the capability to execute unauthorized creation, deletion, or modification of critical data within the application ecosystem."
}