CVE-2026-83251
MediumCVSS 6.5Summary
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product (component: Forge), affecting version 11.4.0. A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via TLS to cause a hang or frequently repeatable crash (complete DoS) and unauthorized read access to a subset of data.
Risk Assessment
An attacker could cause a denial of service and gain access to some data, potentially disrupting the store and breaching confidentiality. However, this requires network access via TLS.
Recommendation
Apply Oracle security updates for Oracle Commerce. Monitor network access and secure TLS communication.
Other vulnerabilities in Oracle Commerce Guided Search / Oracle Commerce Experience Manager
See all- CVE-2026-83259High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) affecting version 11.4.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and cause a partial denial of service. CVSS 3.1 Base Score 7.1.
- CVE-2026-83258High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) affecting version 11.4.0. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via HTTP to take over the product. CVSS 3.1 Base Score 8.1.
- CVE-2026-83257High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) affecting version 11.4.0. A difficult to exploit vulnerability allows a low privileged attacker with network access via HTTP to take over the product. CVSS 3.1 Base Score 7.5.
- CVE-2026-83256High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via TCP to take over the system.
- CVE-2026-83255High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via TCP to take over the system.
- CVE-2026-83254High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via TCP to take over the system.
- CVE-2026-83253High
Vulnerability in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. An easily exploitable flaw allows an unauthenticated attacker with logon to the infrastructure to take over the system, but requires human interaction.
- CVE-2026-83252High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data, modify it, and cause partial denial of service.
- CVE-2026-83250Medium
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product (component: Forge), affecting version 11.4.0. A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and cause a partial denial of service (partial DoS).
- CVE-2026-83249High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows a low privileged attacker with logon to the infrastructure to take over the system, with potential impact on other products.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager and unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H).