EUVD-2026-61962
GHSA-8339-6fc9-29mj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network HTTP access with low complexity gives PR:N/AV:N/AC:L; high confidentiality and integrity impact but no availability effect, matching the authentication-bypass data-access description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller component) lets a remote, unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP. The Oracle advisory and 'Authentication Bypass' tag indicate the flaw sidesteps authentication entirely, and Oracle rates it 'easily exploitable' with CVSS 9.1 (high confidentiality and integrity impact, no availability impact). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network HTTP reachability to the Endeca Application Controller (EAC) management interface of an Oracle Commerce Guided Search / Experience Manager 11.4.0 deployment; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special product configuration are needed against a reachable instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available severity signals point to genuine, high priority: the CVSS 3.1 base score is 9.1 with a fully network-facing, low-complexity, no-privilege, no-interaction vector, and Oracle explicitly labels it 'easily exploitable.' The scope is unchanged but both confidentiality and integrity impacts are High, so an attacker gains broad read and write access to product data without touching availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixes from Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html); Patch available per vendor advisory, though the input does not specify an exact fixed build number for 11.4.0, so confirm the precise patch/bundle in the CPU matrix before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Oracle Commerce Guided Search/Experience Manager 11.4.0 and determine internet/untrusted network exposure; immediately implement firewall rules and WAF policies restricting HTTP access to the Endeca Application Controller to trusted internal networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Commerce Experience Manager
View allFull takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible when a low-privil
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Co
Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Co
Unauthenticated authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Appl
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Conte
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manag
Data tampering and complete denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acqu
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote, unauthenticated attack
Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (the legacy Endeca-derived
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today