CVE-2026-83236 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. It allows an unauthenticated network attacker to exploit the system via HTTP, requiring user interaction from a third party, to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 base score of 8.2 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some accessible data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability affects confidentiality and integrity but does not impact availability. Exploitation requires user interaction from a person other than the attacker and network access via HTTP.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. No indication from the vendor advisory suggests that no action is required or that the issue is already mitigated without patching. Therefore, applying the official patch is the recommended remediation.