A vulnerability in the Endeca Application Controller component of Oracle Commerce Guided Search/Oracle Commerce Experience Manager allows an unauthenticated attacker to send HTTP requests that can create, delete, or modify critical data. This leads to unauthorized changes to data stored or served by the application, compromising its integrity and potentially affecting system functionality due to a lack of proper authentication and access control enforcement.

The affected product is Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Oracle Commerce). The specific version impacted is 11.4.0. The vulnerability applies to installations of this version running on networks that expose the product over HTTP.

The CVSS v3.1 base score of 7.5 indicates a high severity due to integrity impacts. The EPSS score of <1% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers require only network access to the HTTP interface; no local privileges or additional credentials are needed, making the exploit straightforward for anyone who can reach the target. The lack of authentication or proper authorization checks allows the attacker to perform arbitrary operations on the application’s data. The vulnerability’s classification suggests it was easily exploitable, and with no mitigations other than the vendor‑issued fix, the risk remains significant.