Description
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Takeover
Action: Immediate Patch
AI Analysis

Impact

An unauthenticated attacker with network access over TCP can take control of Oracle Commerce Guided Search / Oracle Commerce Experience Manager by exploiting a vulnerability in the Forge component. The flaw, classified as a difficult-to-exploit weakness, grants full confidentiality, integrity, and availability compromise, allowing the attacker to take over the application entirely.

Affected Systems

Oracle Corporation’s Oracle Commerce Guided Search and Oracle Commerce Experience Manager, specifically the component named Forge, are affected. The only documented impacted release is version 11.4.0.

Risk and Exploitability

The vulnerability scores 8.1 on the CVSS 3.1 scale, indicating high severity. The EPSS score is below 1 %, indicating that exploitation is unlikely but still possible at present. It is not yet listed in the CISA KEV catalog. The likely attack vector is unauthenticated network access over TCP to the Forge service, which could allow compromise if the service is exposed.

Generated by OpenCVE AI on September 20, 2026 at 08:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or upgrade to a later Oracle Commerce Guided Search / Oracle Commerce Experience Manager release that fixes the Forge component flaw.
  • If an immediate update is unavailable, restrict incoming TCP traffic to the Forge service by limiting it to trusted IP addresses or placing the service behind a firewall or VPN.
  • Reconfigure or disable the Forge component to enforce authentication before any control commands are accepted.
  • Enable detailed logging for the Forge service and monitor for suspicious activity, generating alerts for attempted connections that fail authentication or exhibit anomalous patterns.

Generated by OpenCVE AI on September 20, 2026 at 08:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 06:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle commerce Guided Search / Oracle Commerce Experience Manager
Vendors & Products Oracle commerce Guided Search / Oracle Commerce Experience Manager

Sun, 20 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Attack Enables Full Takeover of Oracle Commerce Guided Search

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Remote Takeover Vulnerability in Oracle Commerce Guided Search
Weaknesses CWE-284
CWE-287

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
Title Remote Takeover Vulnerability in Oracle Commerce Guided Search
Weaknesses CWE-284
CWE-287

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
CPEs cpe:2.3:a:oracle:commerce_guided_search_\/_oracle_commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Commerce Guided Search / Oracle Commerce Experience Manager Commerce Guided Search \/ Oracle Commerce Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:10:40.220Z

Reserved: 2026-08-31T15:40:57.349Z

Link: CVE-2026-83255

cve-icon Vulnrichment

Updated: 2026-09-17T13:01:14.838Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:37.750

Modified: 2026-09-17T14:17:37.867

Link: CVE-2026-83255

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T05:45:18Z

Weaknesses
  • CWE-269

    Improper Privilege Management