Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T21:17:59.600Z",
  "pubdate": "2026-08-18T21:17:59.600Z",
  "executiveSummary": "This vulnerability affects the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically the Experience Manager component in version 11.4.0. It is an easily exploitable vulnerability that allows an unauthenticated remote attacker with network access via HTTP to compromise the target application. Successful exploitation requires human interaction from a user other than the attacker and results in a security scope change. The attack impacts both confidentiality and integrity, leading to unauthorized read, update, insert, or delete access to a subset of accessible data within the application. The CVSS 3.1 base score is 6.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The primary risk stems from exposure over the network without requiring prior authentication or privileges, relying instead on victim interaction to execute the malicious sequence.",
  "technicalDetails": "The vulnerability resides within the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The flaw is exposed via the HTTP protocol over the network, allowing unauthenticated attackers with network accessibility to interact with the vulnerable application endpoints. Exploitation does not require any prior privileges (PR:N) and is characterized as having a low attack complexity (AC:L), meaning the conditions for a successful attack are straightforward to establish.\nA critical prerequisite for successful exploitation is human interaction (UI:R), indicating that the attacker must trick a victim into performing an action, such as clicking a malicious link or visiting a compromised web page that interacts with the vulnerable Oracle Commerce instance. The vulnerability exhibits a scope change (S:C), signifying that a successful attack against the Experience Manager component can significantly impact additional downstream or interconnected products outside the immediate security boundary of the vulnerable component.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a malicious HTTP payload designed to target the Experience Manager component. Second, the attacker induces a targeted user to perform an action involving the crafted payload via the web browser, fulfilling the human interaction requirement. Third, upon processing the request, the application executes the injected instructions within the context of the victim's session or browser, bypassing initial authentication boundaries due to the lack of required attacker credentials. Finally, the exploitation results in unauthorized data exposure and modification capabilities.\nThe post-exploitation impact includes unauthorized read access to a subset of accessible data, compromising confidentiality, as well as unauthorized update, insert, or delete access to application data, compromising integrity. Availability (A:N) remains unaffected by this specific vulnerability vector."
}