CVE-2026-83240 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It is an easily exploitable vulnerability requiring low privileges and no user interaction, allowing attackers with logon access to the infrastructure to compromise the product. Successful exploitation can result in unauthorized modification of critical data and cause denial of service conditions by hanging or crashing the application. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, reflecting local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

The vulnerability enables an attacker with low privileges and logon access to the affected infrastructure to perform unauthorized creation, deletion, or modification of critical data within Oracle Commerce Guided Search / Experience Manager. Additionally, the attacker can cause a denial of service by hanging or repeatedly crashing the application, impacting availability. There is no confidentiality impact reported.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No indication was given that the vulnerability is already mitigated or requires no action.