CVE-2026-83238

Authentication Bypass in Oracle Commerce Guided Search/Experience Manager Enabling Unauthorized Data Access and Partial Denial of Service

View on CVE.org
Published Sep 15, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Description
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

Analysis

AI-generated

Technical impact

A flaw in the Forge component of Oracle Commerce Guided Search/Experience Manager allows a low‑privileged attacker who can reach the service over HTTP to bypass authentication checks. The vulnerability can lead to unauthorized reading of critical data, full access to all data exposed by the Commerce solution, and the ability to cause a partial denial of service by disrupting application functionality. It is a classic authentication bypass and access control weakness.

Affected Systems

Affected systems are Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. No other product variants or versions are reported by the CNA.

Risk and Exploitability

The CVSS v3.1 base score of 7.1 classifies this issue as medium‑high risk, requiring only network access, low attack complexity, and low privileges. The EPSS score below 1% indicates that exploitation is predicted to be rare, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is through unauthenticated HTTP requests to the affected Forge component, meaning exposed instances are at significant risk if not patched.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch to Oracle Commerce Guided Search version 11.4.0 to eliminate the authentication bypass.
  • Restrict HTTP access to the Commerce servers to trusted IP ranges or a VPN to reduce exposure.
  • Deploy a web‑application firewall or similar monitoring that flags anomalous authentication requests and blocks suspected exploitation attempts.

Generated by OpenCVE AI on September 20, 2026 at 08:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Authentication Bypass in Oracle Commerce Guided Search/Experience Manager Enabling Unauthorized Data Access and Partial Denial of Service
Weaknesses CWE-200
Type Values Removed Values Added
Title Authentication Bypass in Oracle Commerce Guided Search Forge Component
Weaknesses CWE-284
CWE-287
Type Values Removed Values Added
Title Authentication Bypass in Oracle Commerce Guided Search Forge Component
Weaknesses CWE-284
CWE-287
Type Values Removed Values Added
First Time appeared Oracle commerce Guided Search / Oracle Commerce Experience Manager
Vendors & Products Oracle commerce Guided Search / Oracle Commerce Experience Manager
Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
First Time appeared Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
CPEs cpe:2.3:a:oracle:commerce_guided_search_\/_oracle_commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}
Earlier changes (1)
Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

Sources

Status
PUBLISHED
Assigner
oracle
Published
Updated
Sep 21, 2026, 4:58 PM
Reserved
Aug 31, 2026, 3:40 PM

View source JSON

Updated
Sep 21, 2026, 4:58 PM

JSON

Status
Deferred
Published
Sep 15, 2026, 8:18 PM
Modified
Sep 21, 2026, 5:19 PM

View source JSON

No data.

Updated
Sep 20, 2026, 9:00 AM

JSON