Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T21:18:00.987Z",
  "pubdate": "2026-08-18T21:18:00.987Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically residing in the Endeca Application Controller component. The vulnerability affects the supported version 11.4.0 and can be leveraged by an unauthenticated attacker over network protocols via HTTP. Successful exploitation of this security flaw requires human interaction from a victim other than the attacker. Due to a scope change characteristic of the attack vector, successful exploitation may significantly impact additional products beyond the primary vulnerable system. The business risk includes severe confidentiality compromises resulting in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. Furthermore, the vulnerability permits unauthorized update, insert, or delete access to a subset of accessible data, yielding a CVSS 3.1 Base Score of 8.2 with high confidentiality and low integrity impacts.",
  "technicalDetails": "The vulnerability is localized within the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The attack vector is network-based (AV:N), requiring low attack complexity (AC:L) with no prior authentication (PR:N) or privileges required by the threat actor. However, successful exploitation mandates user interaction (UI:R) from a third party. The vulnerability exhibits a scope change (S:C), indicating that a successful exploit against the primary component can transcend security boundaries and severely impact additional collateral products or downstream systems.\nThe exploitation flow begins when an unauthenticated attacker crafts a malicious HTTP-based payload targeting the Endeca Application Controller. Because user interaction is required, the attacker typically induces a legitimate user or administrative operator to interact with the malicious HTTP request or link, often via social engineering or reflected mechanisms. Upon processing the manipulated request within the context of the vulnerable component, the execution flow allows the attacker to bypass access controls. This leads to unauthorized read capabilities yielding complete access to critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager, alongside unauthorized data modification privileges allowing the insertion, update, or deletion of specific subsets of application data.\nThe resulting impact profile encompasses high confidentiality degradation (C:H) due to data exfiltration risks and low integrity degradation (I:L) stemming from unauthorized data tampering. Availability remains unaffected (A:N). The network exposure of the Endeca Application Controller over HTTP combined with the lack of authentication requirements makes this an elevated risk for enterprise environments running version 11.4.0."
}