Description
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution leading to system takeover
Action: Immediate Patch
AI Analysis

Impact

Oracle Commerce Guided Search and Oracle Commerce Experience Manager version 11.4.0 contain a vulnerability in the Forge component that allows an unauthenticated attacker to gain control of the application through the HTTP interface. Successful exploitation can result in full takeover, compromising the confidentiality, integrity, and availability of all data processed by the Commerce Guided Search.

Affected Systems

The vulnerability affects Oracle Commerce Guided Search and Oracle Commerce Experience Manager, specifically the 11.4.0 release. This includes installations that expose the HTTP service of the Guided Search component.

Risk and Exploitability

The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity. The EPSS score is less than 1%, suggesting low to moderate likelihood of widespread exploitation, and it is not listed in CISA’s KEV catalog. Attackers can reach the vulnerable interface via network HTTP access without authentication, sending crafted requests to the Forge component to gain control of the system. No special privileges are required beyond open network connectivity.

Generated by OpenCVE AI on September 20, 2026 at 08:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an available Oracle patch or update for Oracle Commerce Guided Search 11.4.0 that addresses this vulnerability.
  • Restrict HTTP access to the Guided Search interface by limiting inbound traffic to trusted IP addresses or by using a VPN or firewall rules.
  • Monitor system logs for anomalous requests to the Guided Search component and investigate any suspicious activity promptly.

Generated by OpenCVE AI on September 20, 2026 at 08:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Commerce Guided Search 11.4.0

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Compromise via HTTP in Oracle Commerce Guided Search
Weaknesses CWE-284

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Compromise via HTTP in Oracle Commerce Guided Search
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
CPEs cpe:2.3:a:oracle:commerce_guided_search_\/_oracle_commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Commerce Guided Search \/ Oracle Commerce Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:10:39.746Z

Reserved: 2026-08-31T15:40:57.349Z

Link: CVE-2026-83258

cve-icon Vulnrichment

Updated: 2026-09-17T13:01:05.830Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:38.073

Modified: 2026-09-17T14:17:38.207

Link: CVE-2026-83258

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T09:00:13Z

Weaknesses
  • CWE-269

    Improper Privilege Management