CVE-2026-83253
HighCVSS 7.8Summary
Vulnerability in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. An easily exploitable flaw allows an unauthenticated attacker with logon to the infrastructure to take over the system, but requires human interaction.
Risk Assessment
Successful exploitation can lead to full takeover of the Oracle Commerce system, threatening confidentiality, integrity and availability of data. CVSS score 7.8 indicates high risk.
Recommendation
Update Oracle Commerce Guided Search / Oracle Commerce Experience Manager to the version containing Oracle's security fix. Restrict infrastructure access and educate users about interacting with untrusted content.
Other vulnerabilities in Oracle Commerce Guided Search / Oracle Commerce Experience Manager
See all- CVE-2026-83259High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) affecting version 11.4.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and cause a partial denial of service. CVSS 3.1 Base Score 7.1.
- CVE-2026-83258High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) affecting version 11.4.0. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via HTTP to take over the product. CVSS 3.1 Base Score 8.1.
- CVE-2026-83257High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) affecting version 11.4.0. A difficult to exploit vulnerability allows a low privileged attacker with network access via HTTP to take over the product. CVSS 3.1 Base Score 7.5.
- CVE-2026-83256High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via TCP to take over the system.
- CVE-2026-83255High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via TCP to take over the system.
- CVE-2026-83254High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via TCP to take over the system.
- CVE-2026-83252High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data, modify it, and cause partial denial of service.
- CVE-2026-83251Medium
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product (component: Forge), affecting version 11.4.0. A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via TLS to cause a hang or frequently repeatable crash (complete DoS) and unauthorized read access to a subset of data.
- CVE-2026-83250Medium
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product (component: Forge), affecting version 11.4.0. A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and cause a partial denial of service (partial DoS).
- CVE-2026-83249High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows a low privileged attacker with logon to the infrastructure to take over the system, with potential impact on other products.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).