Description
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data exposure and partial denial of service
Action: Patch
AI Analysis

Impact

The vulnerability resides in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It allows a low‑privileged attacker who can reach the application over HTTP to obtain unauthorized access to critical or all accessible data and to cause a partial denial of service. The flaw is an access control weakness that impacts confidentiality and availability, as reflected by a CVSS 3.1 base score of 7.1 with high confidentiality impact and low availability impact.

Affected Systems

Oracle Corporation’s Oracle Commerce Guided Search and Oracle Commerce Experience Manager running version 11.4.0 are the impacted delivery mechanisms. The flaw affects installations that expose the Forge component to the network.

Risk and Exploitability

The EPSS score of less than 1% suggests a low probability of exploitation, yet the CVSS base score of 7.1 indicates a high severity posture. The vulnerability can be exploited remotely via HTTP by an attacker with low privileges to read or modify data and to reduce service availability. The flaw is not listed in the CISA KEV catalog, but its potential impact warrants attention. Based on the description, it is inferred that the attack does not require user interaction.

Generated by OpenCVE AI on September 21, 2026 at 19:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and deploy the latest Oracle patch for Oracle Commerce Guided Search version 11.4.0 that addresses the Forge component flaw.
  • Restrict HTTP access to the Guided Search service to trusted networks or block untrusted external requests to limit exposure.
  • Enforce least privilege access controls on the Commerce Experience Manager so that only authenticated users with appropriate roles can view or modify data.
  • Monitor application logs for anomalous access or denial‑of‑service patterns.

Generated by OpenCVE AI on September 21, 2026 at 19:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Sun, 20 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
Title Improper Access Control in Oracle Commerce Guided Search Allows Data Exposure and Partial Denial of Service
Weaknesses CWE-284

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Vulnerability in Oracle Commerce Enables Data Exposure and Partial DoS
Weaknesses CWE-284
CWE-399

Wed, 16 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Vulnerability in Oracle Commerce Enables Data Exposure and Partial DoS
Weaknesses CWE-284
CWE-399

Wed, 16 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle commerce Guided Search / Oracle Commerce Experience Manager
Vendors & Products Oracle commerce Guided Search / Oracle Commerce Experience Manager

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
First Time appeared Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
CPEs cpe:2.3:a:oracle:commerce_guided_search_\/_oracle_commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

Subscriptions

Oracle Commerce Guided Search / Oracle Commerce Experience Manager Commerce Guided Search \/ Oracle Commerce Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-21T17:10:11.462Z

Reserved: 2026-08-31T15:40:57.349Z

Link: CVE-2026-83259

cve-icon Vulnrichment

Updated: 2026-09-21T17:10:03.939Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:38.183

Modified: 2026-09-21T18:17:11.317

Link: CVE-2026-83259

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T19:30:15Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control