A flaw in Oracle Commerce Guided Search/Experience Manager’s Endeca Application Controller allows a low‑privileged attacker with network access via HTTP to gain unauthorized read or write access to critical data. The vulnerability can result in reading, updating, or deleting data that should be protected, producing confidentiality and integrity impacts as indicated by its CVSS 3.1 base score of 7.6.

Oracle Corporation’s Oracle Commerce Guided Search and Oracle Commerce Experience Manager, specifically version 11.4.0, are affected. The issue resides in the Endeca Application Controller component of this product.

The CVSS base score of 7.6 reflects a moderate to high severity, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known public exploits. The likely attack vector is via HTTP to the exposed component, requiring an attacker to be on a low‑privileged host with network reachability to the server and human interaction from a user other than the attacker to trigger the vulnerability. The scope change noted in the vector means a successful compromise could also impact linked or dependent products.