Description
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A difficult-to-exploit vulnerability exists in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component named Forge. Based on the description, it is inferred that this weakness is an improper privilege management flaw (CWE-269). An attacker who is low privileged and can reach the application over HTTP may successfully compromise the entire Guided Search / Experience Manager instance, leading to full compromise of confidentiality, integrity, and availability of the application.

Affected Systems

The vulnerability affects Oracle Commerce Guided Search and Oracle Commerce Experience Manager versions 11.4.0. Only this version is listed as supported and affected.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires network access via HTTP and low privileges, meaning a remote attacker with unauthenticated or minimal authenticated access may gain full control over the application.

Generated by OpenCVE AI on September 20, 2026 at 08:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to a non‑affected version of Oracle Commerce Guided Search / Experience Manager.
  • Limit inbound HTTP traffic to the application to trusted IP addresses or through a firewall rule set to reduce exposure.
  • Monitor application logs and network traffic for abnormal requests or signs of attempted exploitation, and investigate any anomalies promptly.

Generated by OpenCVE AI on September 20, 2026 at 08:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Title Remote Takeover via Improper Privilege Management in Oracle Commerce Guided Search

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution Vulnerability in Oracle Commerce Guided Search (v11.4.0)
Weaknesses CWE-284

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution Vulnerability in Oracle Commerce Guided Search (v11.4.0)
Weaknesses CWE-284

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle commerce Guided Search / Oracle Commerce Experience Manager
Vendors & Products Oracle commerce Guided Search / Oracle Commerce Experience Manager

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
CPEs cpe:2.3:a:oracle:commerce_guided_search_\/_oracle_commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Commerce Guided Search / Oracle Commerce Experience Manager Commerce Guided Search \/ Oracle Commerce Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:10:39.898Z

Reserved: 2026-08-31T15:40:57.349Z

Link: CVE-2026-83257

cve-icon Vulnrichment

Updated: 2026-09-17T13:01:08.785Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:37.970

Modified: 2026-09-17T14:17:38.097

Link: CVE-2026-83257

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T08:30:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management