Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-18T21:18:03.427Z",
  "pubdate": "2026-08-18T21:18:03.427Z",
  "executiveSummary": "A security vulnerability has been identified within the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product, specifically affecting the Experience Manager component in version 11.4.0. This flaw presents significant risk due to its high CVSS 3.1 base score of 9.3, driven by severe impacts to data confidentiality and integrity. The vulnerability is easily exploitable by an unauthenticated attacker interacting over the network via HTTP, provided that a secondary user performs required human interaction. Successful exploitation yields unauthorized read, create, delete, and modify access to critical or all accessible data within the affected system. Furthermore, the vulnerability exhibits a scope change, meaning that successful attacks can extend beyond Oracle Commerce Guided Search / Oracle Commerce Experience Manager to significantly impact additional secondary products. The combination of network accessibility, lack of authentication requirements, and high-impact data compromise necessitates prompt defensive evaluation and remediation actions by administrators managing the specified Oracle Commerce environment.",
  "technicalDetails": "The vulnerability resides within the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The flaw manifests in how the application handles incoming HTTP traffic and processes user-supplied data in scenarios involving human interaction from an authenticated or interacting user other than the attacker. The attack vector is strictly network-based (AV:N), allowing remote threat actors without any prior authentication (PR:N) or low attack complexity (AC:L) to target the application.\nExploitation requires user interaction (UI:R), meaning the target or a third-party user must be induced to perform a specific action, such as interacting with a maliciously crafted link or resource delivered over HTTP. Because the vulnerability features a scope change (S:C), the compromise crosses security boundaries, enabling the attacker to leverage the context of the vulnerable Oracle Commerce component to affect additional, downstream or integrated products and systems.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious HTTP request or payload designed to exploit the input handling or processing logic within the Experience Manager component. Second, the attacker induces a victim to initiate a workflow or interact with the malicious content via required human interaction. Third, upon processing the request within the application context, the vulnerability triggers, bypassing standard access controls due to the scope change vector. Finally, the attacker achieves unauthorized execution capabilities resulting in high confidentiality (C:H) and high integrity (I:H) impacts, permitting the unauthorized creation, deletion, or modification of critical system data, as well as unauthorized read access to complete data stores accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager and potentially secondary impacted products. Availability impact remains unaffected (A:N)."
}