CVE-2026-83237 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge), specifically affecting version 11.4.0. The vulnerability is exploitable over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to unauthorized access to critical data and partial denial of service conditions. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

The vulnerability allows unauthorized access to critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and can cause a partial denial of service. Confidentiality is highly impacted, while availability impact is low. There is no impact on integrity. The vulnerability can be exploited remotely over HTTP by an attacker with low privileges, increasing the risk of compromise if patches are not applied.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 should apply the official patch without delay to remediate this vulnerability. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation.