Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T21:17:59.717Z",
  "pubdate": "2026-08-18T21:17:59.717Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This security flaw allows unauthenticated remote attackers with network access via HTTP to compromise the targeted system, contingent upon human interaction from a victim other than the attacker. Successful exploitation of this vulnerability induces a security scope change, potentially impacting additional integrated products within the enterprise environment. The primary impact of a successful attack encompasses unauthorized read access to a subset of accessible data, alongside unauthorized update, insert, or delete capabilities against specific data repositories managed by the affected application. With a CVSS 3.1 Base Score of 6.1, the risk profile highlights moderate confidentiality and integrity degradation stemming from network-vectored inputs lacking required pre-authentication privileges.",
  "technicalDetails": "The vulnerability resides in the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. The flaw manifests in how the application processes incoming HTTP requests across network vectors, lacking adequate validation or sanitization mechanisms to safely handle untrusted input parameters in scenarios involving third-party interaction. The attack surface is exposed over standard HTTP protocols, allowing any unauthenticated remote adversary with network connectivity to initiate malicious requests targeting the vulnerable service. Exploitation requires user interaction, meaning a victim must perform an action—such as clicking a malicious link or interacting with a crafted web page—to facilitate the attack delivery mechanism. Upon successful exploitation, the vulnerability triggers a security scope change (S:C), indicating that the compromise extends beyond the immediate trust boundary of the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component, potentially impacting supplementary products or underlying architectural layers linked within the deployment ecosystem. The resulting post-exploitation impact includes unauthorized data manipulation primitives, granting the adversary the ability to execute unauthorized insert, update, or delete operations against targeted data sets, as well as unauthorized read access (C:L, I:L, A:N) targeting a specific subset of accessible application data. The attack flow relies on the adversary constructing a specially crafted HTTP payload, delivering it via network vectors, and leveraging human interaction to execute the request within the context of the user session, thereby bypassing authentication requirements (PR:N) while maintaining low attack complexity (AC:L)."
}