CVE-2026-83244
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. A difficult-to-exploit flaw allows an unauthenticated attacker with access to the physical communication segment to compromise the application. It results in unauthorized access to critical data, data modification, and complete denial of service.
Risk Assessment
An attacker with local network access could gain access to critical data, modify it, and cause service unavailability, potentially disrupting e-commerce operations.
Recommendation
Update Oracle Commerce Guided Search / Oracle Commerce Experience Manager to the latest version containing the security fix. Restrict physical access to network segments where the application operates.
Other vulnerabilities in Oracle Commerce Guided Search / Oracle Commerce Experience Manager
See all- CVE-2017-3572High
A vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component allows an unauthenticated attacker with network access via HTTP to remotely hang or frequently crash the system. Affected versions are 6.2.2, 6.3.0, 6.4.1.2, 6.5.0, 6.5.1, and 6.5.2.
- CVE-2026-71037Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Experience Manager component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to data and modify it. User interaction is required. CVSS score is 9.3.
- CVE-2026-71036Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Experience Manager component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to data and modify it. CVSS score is 9.1.
- CVE-2026-71026Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to data and modify it. CVSS score is 9.1.
- CVE-2026-71015Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to data and modify it. CVSS score is 9.1.
- CVE-2026-71014Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to data and modify it. CVSS score is 9.1.
- CVE-2026-70998Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) affects version 11.4.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and modify some data. The attack may impact additional products. CVSS score is 9.3.
- CVE-2026-61161Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker can take over the system via HTTP.
- CVE-2026-61153Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Experience Manager component) allows an unauthenticated attacker via HTTP to unauthorizedly create, delete, or modify critical data and gain full access to all data.
- CVE-2026-61146Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (version 11.4.0) allows a low-privileged attacker with network access via HTTP to compromise the product. Attacks may impact additional products (scope change). CVSS 9.9.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS