Description
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution leading to system compromise
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the Forge component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager, which is exposed to the public internet via HTTP. It is an unauthenticated flaw that, if exploited, allows an attacker to take full control of the application. The weakness corresponds to CWE‑269 Improper Privilege Management, permitting unauthenticated users to perform privileged operations.

Affected Systems

Oracle Commerce Guided Search and Oracle Commerce Experience Manager version 11.4.0 are affected. The issue is reported in the Forge module used by these products and only applies to the 11.4.0 release.

Risk and Exploitability

The CVSS base score is 8.1, which reflects full confidentiality, integrity, and availability compromise. The EPSS score is less than 1 %, indicating a low probability of widespread exploitation at present, and the vulnerability is not in the CISA KEV catalog. Nevertheless, because the flaw requires no credentials and is reachable via a network request, it remains a straightforward remote exploitation vector for any host exposed to the public network.

Generated by OpenCVE AI on September 20, 2026 at 09:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑released security patch that addresses the Forge component.
  • Enable detailed logging and monitoring of the Forge interfaces, and regularly audit the system for signs of unauthorized activity.
  • Restrict network access to the Forge interfaces through firewall rules or a VPN, allowing only trusted IP addresses.

Generated by OpenCVE AI on September 20, 2026 at 09:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Takeover via HTTP in Oracle Commerce Guided Search

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Oracle Commerce Guided Search Remote Code Execution Vulnerability
Weaknesses CWE-94

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title Oracle Commerce Guided Search Remote Code Execution Vulnerability
Weaknesses CWE-94

Wed, 16 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle commerce Guided Search / Oracle Commerce Experience Manager
Vendors & Products Oracle commerce Guided Search / Oracle Commerce Experience Manager

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
CPEs cpe:2.3:a:oracle:commerce_guided_search_\/_oracle_commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Commerce Guided Search / Oracle Commerce Experience Manager Commerce Guided Search \/ Oracle Commerce Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:10:41.162Z

Reserved: 2026-08-31T15:40:57.348Z

Link: CVE-2026-83245

cve-icon Vulnrichment

Updated: 2026-09-17T13:01:29.425Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:36.597

Modified: 2026-09-17T14:17:37.173

Link: CVE-2026-83245

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T09:15:17Z

Weaknesses
  • CWE-269

    Improper Privilege Management