CVE-2026-83259
HighCVSS 7.1Summary
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) affecting version 11.4.0. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and cause a partial denial of service. CVSS 3.1 Base Score 7.1.
Risk Assessment
Possible leakage of critical data and partial disruption of service availability, which may affect e-commerce platform operation. It requires low privileges.
Recommendation
Apply Oracle security updates for version 11.4.0 and restrict user privileges with access to the Forge component.
Other vulnerabilities in Oracle Commerce Guided Search / Oracle Commerce Experience Manager
See all- CVE-2026-83258High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) affecting version 11.4.0. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via HTTP to take over the product. CVSS 3.1 Base Score 8.1.
- CVE-2026-83257High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component) affecting version 11.4.0. A difficult to exploit vulnerability allows a low privileged attacker with network access via HTTP to take over the product. CVSS 3.1 Base Score 7.5.
- CVE-2026-83256High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via TCP to take over the system.
- CVE-2026-83255High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via TCP to take over the system.
- CVE-2026-83254High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via TCP to take over the system.
- CVE-2026-83253High
Vulnerability in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. An easily exploitable flaw allows an unauthenticated attacker with logon to the infrastructure to take over the system, but requires human interaction.
- CVE-2026-83252High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data, modify it, and cause partial denial of service.
- CVE-2026-83251Medium
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product (component: Forge), affecting version 11.4.0. A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via TLS to cause a hang or frequently repeatable crash (complete DoS) and unauthorized read access to a subset of data.
- CVE-2026-83250Medium
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product (component: Forge), affecting version 11.4.0. A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and cause a partial denial of service (partial DoS).
- CVE-2026-83249High
Vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A difficult to exploit flaw allows a low privileged attacker with logon to the infrastructure to take over the system, with potential impact on other products.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).