Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T21:18:02.610Z",
  "pubdate": "2026-08-18T21:18:02.610Z",
  "executiveSummary": "An unauthenticated network-exploitable vulnerability exists within the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This security flaw allows remote attackers with network access via HTTP to compromise the affected system without requiring authentication, user interaction, or elevated privileges. The vulnerability exhibits a scope change, meaning that successful exploitation can extend the security impact beyond the primary product to compromise additional connected systems or resources. The primary impact of successful exploitation includes unauthorized read access to a subset of accessible data, as well as unauthorized update, insert, or delete access to specific data managed by the application. Given the remote attack vector, low attack complexity, and lack of authentication requirements, the vulnerability presents a significant risk to organizational data integrity and confidentiality. Security analysts have assigned a CVSS 3.1 Base Score of 7.2, reflecting the severity of the confidentiality and integrity impacts associated with this flaw.",
  "technicalDetails": "The vulnerability resides in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The root cause stems from insufficient access controls and inadequate request validation mechanisms within the application's HTTP interface, which allows remote entities to interact with sensitive administrative and data-handling functions without verifying authentication credentials. The attack vector is strictly network-based, utilizing the HTTP protocol to transmit crafted requests directly to the vulnerable component. Exploitation requires no prior authentication (PR:N) and no user interaction (UI:N), with low attack complexity (AC:L), making the vulnerability trivial to target for any attacker with standard network reachability over HTTP. The attack flow begins when an unauthenticated threat actor sends a maliciously crafted HTTP request to the Endeca Application Controller endpoint. Due to the absence of robust session validation and access control enforcement, the application processes the request as a legitimate administrative or operational command. Because the vulnerability involves a scope change (S:C), the execution context of the request is not strictly confined to the immediate boundaries of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, potentially granting the attacker unauthorized interaction capabilities with secondary components or integrated products within the broader Oracle Commerce ecosystem. Upon successful processing of the malicious payload, the post-exploitation impact allows the adversary to bypass intended security perimeters to compromise data states. Specifically, the attacker gains unauthorized read access to a subset of sensitive data accessible via the application, alongside unauthorized write capabilities that permit the updating, insertion, or deletion of specific data sets. The lack of integrity controls combined with exposed data surfaces creates significant risk for unauthorized data tampering and information disclosure within affected environments."
}