Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-18T21:17:59.360Z",
  "pubdate": "2026-08-18T21:17:59.360Z",
  "executiveSummary": "A security vulnerability has been identified within the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically residing in the Experience Manager component.\nThe vulnerability affects the supported version 11.4.0 and can be exploited by a low-privileged attacker with network access via the HTTP protocol.\nSuccessful exploitation of this flaw does not require user interaction and allows an adversary to compromise the affected system, resulting in a significant scope change that can impact additional products.\nThe impact includes unauthorized creation, deletion, or modification access to critical data or all accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager, alongside unauthorized read access to a subset of accessible data.\nWith a CVSS 3.1 Base Score of 8.5, this vulnerability presents severe integrity and confidentiality risks.\nOrganizations deploying the affected Oracle Commerce version must treat this as a high-priority risk and implement available vendor-supplied patches or defensive hardening measures to prevent unauthorized data manipulation and potential cross-product compromise.",
  "technicalDetails": "The vulnerability exists within the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0.\nThe attack vector is network-based (AV:N), meaning an attacker can initiate exploitation remotely over HTTP without requiring physical access to the underlying infrastructure.\nThe complexity of the attack is low (AC:L), and it requires low privileges (PR:L), indicating that an authenticated user with minimal access rights can successfully execute the attack.\nNo user interaction (UI:N) is required, streamlining the exploitation process for an adversary.\nA notable characteristic of this vulnerability is the scope change (S:C), which implies that a successful attack originating within Oracle Commerce Guided Search / Oracle Commerce Experience Manager can propagate or impact additional downstream or integrated products within the environment.\nThe step-by-step attack flow begins with the low-privileged attacker establishing an HTTP connection to the vulnerable endpoint exposed by the Experience Manager component.\nThe attacker then submits crafted requests designed to bypass authorization boundaries or exploit input validation flaws within the component.\nBecause the application fails to adequately enforce access controls and authorization checks for the requested operations, the malicious payload is processed successfully.\nUpon successful processing, the attacker gains unauthorized read access to a subset of sensitive data, as well as unauthorized creation, deletion, and modification capabilities targeting critical data or all accessible data within the scope of Oracle Commerce Guided Search / Oracle Commerce Experience Manager.\nThe post-exploitation impact spans severe integrity violations and partial confidentiality breaches, potentially compromising the operational integrity of the broader enterprise ecosystem due to the scope change vector."
}