Oracle Commerce Endeca EUVD-2026-61943

Exploitation requires HTTP network access to the Endeca Application Controller component on Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no special conditions apply - remote unauthenticated exploitation is possible against default configurations of Oracle Commerce Guided Search 11.4.0. Exploitation is limited to this specific version per the advisory; no other supported versions are listed. Internet-exposed deployments face the highest risk; deployments where the Application Controller is network-isolated behind a firewall or VPN have partial mitigation through network segmentation, which is not a sufficient long-term substitute for patching. No privileged account, specific feature flag, or non-default configuration is required to trigger the vulnerability.

The CVSS 8.6 score reflects a severe risk configuration: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and scope-changing with high confidentiality impact (S:C/C:H). These metrics are internally consistent with the description of unauthenticated HTTP-based authentication bypass. EPSS data was not available in the supplied intelligence, so probabilistic exploitation likelihood cannot be quantified. KEV status is negative and no POC is referenced, so active exploitation cannot be confirmed at this time. Nevertheless, even a mid-sized municipal IT team in radom operating Oracle Commerce Guided Search 11.4.0 in any internet-facing capacity should treat this as urgent given the zero-authentication, low-complexity exploitation path. The scope change is a material amplifier: the Endeca Application Controller's administrative role within the platform means credential or configuration data extracted from it may enable lateral movement across connected Oracle Commerce components, making the effective blast radius larger than a confidentiality-only CVSS score might suggest on its face.

An unauthenticated attacker with HTTP network access to a host running Oracle Commerce Guided Search 11.4.0 sends a crafted HTTP request directly to the Endeca Application Controller endpoint, bypassing its authentication controls without any credentials or user interaction. The attacker retrieves critical configuration data, internal service credentials, or the full dataset accessible through the Commerce platform, and may subsequently pivot to additional connected Oracle Commerce Experience Manager components due to the confirmed scope change. No public exploit code has been identified at time of analysis, but the low-complexity, zero-authentication vector means exploitation requires no specialized tooling.