CVE-2026-83234 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is an easily exploitable vulnerability that permits unauthenticated attackers with network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible data within the product, as well as unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low integrity impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update advisory.

The vulnerability allows unauthenticated remote attackers to access sensitive data and partially modify data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0. This can lead to unauthorized disclosure of critical information and unauthorized data manipulation, impacting confidentiality and integrity of the affected system. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a security patch for this vulnerability as part of its September 2026 Critical Security Patch Update. Customers using Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should apply the provided patch promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.