Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:18:00.763Z",
  "pubdate": "2026-08-18T21:18:00.763Z",
  "executiveSummary": "An unauthenticated vulnerability affects the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This easily exploitable flaw allows remote attackers with network access via HTTP to interact with the system without providing credentials.\nSuccessful exploitation compromises the confidentiality and integrity of the targeted application. Unauthorized actors gain capabilities to create, modify, or delete critical data, alongside gaining complete or critical unauthorized access to all accessible data within the Oracle Commerce Guided Search / Oracle Commerce Experience Manager environment.\nWith a CVSS 3.1 Base Score of 9.1 and a vector of (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the risk implications are severe. The absence of authentication requirements, low attack complexity, and network vector make this vulnerability highly critical for organizations utilizing the affected product version.",
  "technicalDetails": "The vulnerability resides within the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The root cause stems from insufficient access controls and lack of authentication enforcement within HTTP-based communication channels exposed by the application.\nExploitation requires network access via HTTP targeting the vulnerable Endeca Application Controller component. Because the attack vector is network-based (AV:N), attack complexity is low (AC:L), and privileges are not required (PR:N), an unauthenticated remote threat actor can directly interact with exposed administrative or operational endpoints without user interaction (UI:N).\nThe attack flow proceeds as follows: First, the attacker identifies the exposed HTTP services associated with the Endeca Application Controller on the target system. Second, the attacker crafts malicious HTTP requests targeted at sensitive application functionalities, bypassing authentication mechanisms due to the flawed validation logic within the component. Third, the attacker transmits the payload over the network. Upon receipt, the Endeca Application Controller processes the unauthorized requests.\nThe post-exploitation impact allows the adversary to perform unauthorized data manipulation, resulting in the creation, deletion, or modification of critical data. Furthermore, the attacker achieves unauthorized read access to critical and sensitive data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager, while availability impact remains unexpressed (A:N)."
}