Description
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager and unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).
Published: 2026-09-15
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service and Partial Data Exposure
Action: Check for Update
AI Analysis

Impact

The flaw resides in the Forge component of Oracle Commerce Guided Search/Experience Manager version 11.4.0. An unauthenticated attacker can send crafted HTTP requests that cause the application to hang or crash, resulting in a complete denial of service. At the same time the request pattern allows the attacker to read a subset of data that the component exposes, exposing sensitive information.

Affected Systems

Oracle Corporation’s Oracle Commerce Guided Search and Oracle Commerce Experience Manager, specifically the 11.4.0 release. No other product versions are indicated in the advisory.

Risk and Exploitability

The CVSS 3.1 base score of 8.2 denotes high availability impact and low confidentiality impact. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires only network access over HTTP and no authentication, so the attack vector is straightforward and the condition for exploitation is minimal.

Generated by OpenCVE AI on September 20, 2026 at 08:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Review Oracle’s security advisories for any available patch or update that addresses the Forge component flaw in version 11.4.0.
  • Restrict HTTP traffic to the Commerce Guided Search interfaces to trusted IP ranges or enforce VPN access to limit unauthenticated exposure.
  • Configure application and web‑server resource limits and monitor for abnormal hang or crash events and data‑reading anomalies to detect potential exploitation.

Generated by OpenCVE AI on September 20, 2026 at 08:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Request Exploit in Oracle Commerce Guided Search 11.4.0 Causes DoS and Data Exposure
Weaknesses CWE-284
CWE-400

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-driven Denial of Service and Data Exposure in Oracle Commerce Guided Search
Weaknesses CWE-200
CWE-400

Wed, 16 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-driven Denial of Service and Data Exposure in Oracle Commerce Guided Search
Weaknesses CWE-200
CWE-400

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager and unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).
First Time appeared Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
CPEs cpe:2.3:a:oracle:commerce_guided_search_\/_oracle_commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

Oracle Commerce Guided Search \/ Oracle Commerce Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-21T17:03:45.333Z

Reserved: 2026-08-31T15:40:57.349Z

Link: CVE-2026-83248

cve-icon Vulnrichment

Updated: 2026-09-21T17:03:41.470Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:36.963

Modified: 2026-09-21T17:19:07.957

Link: CVE-2026-83248

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T08:30:16Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-400

    Uncontrolled Resource Consumption