Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T21:18:02.840Z",
  "pubdate": "2026-08-18T21:18:02.840Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically targeting the Endeca Application Controller component. The vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the affected system without requiring any user interaction. Due to the architectural characteristics of the flaw, successful exploitation results in a scope change, meaning that attacks may significantly impact additional products beyond the primary target. The security impact is characterized by unauthorized read, update, insert, and delete access to a subset of accessible data within the application. Based on the CVSS 3.1 scoring, the vulnerability receives a Base Score of 7.2 with impacts strictly limited to confidentiality and integrity. The combination of network accessibility, lack of authentication requirements, and broad data exposure implications present a notable risk to enterprise environments deploying the unsupported version 11.4.0.",
  "technicalDetails": "The vulnerability resides in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The root cause stems from insufficient access controls and inadequate input validation or request handling mechanisms exposed via the network protocol layer. Because the attack vector is network-based (AV:N), an adversary does not require local access or physical proximity to the target infrastructure. Furthermore, the attack complexity is assessed as low (AC:L), indicating that the flaw can be reliably exploited without requiring complex race conditions, specific timing constraints, or advanced cryptographic bypasses.\nExploitation requires no privileges (PR:N) and no user interaction (UI:N), allowing automated scripts or unauthenticated malicious actors to directly interact with the vulnerable HTTP service endpoints. The attack flow begins when an external threat actor transmits a crafted HTTP request to the exposed Endeca Application Controller interface. Due to the absence of proper authentication and authorization enforcement within the component, the application processes the malicious payload as a legitimate administrative or control instruction.\nUpon successful execution of the payload, the scope change (S:C) characteristic of the vulnerability enables the attacker to transcend the trust boundary of the immediate component. This facilitates unauthorized interaction with interconnected systems or additional products managed or influenced by the Oracle Commerce Guided Search / Oracle Commerce Experience Manager architecture. The post-exploitation impact allows the adversary to read sensitive data subsets as well as perform unauthorized data modifications, including updates, insertions, and deletions of accessible records. The lack of integrity controls ensures that manipulated data persists within the application state, potentially leading to data corruption or unauthorized disclosure of proprietary business information across the affected product ecosystem."
}