CVE-2026-83244 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. The flaw requires an attacker to have physical access to the communication segment attached to the hardware where the product runs. Exploitation can lead to unauthorized access to critical data, limited unauthorized data modification, and denial of service conditions. The CVSS 3.1 vector is AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H, reflecting attack complexity and required access conditions.

Successful exploitation can result in unauthorized access to critical data, unauthorized insert, update, or delete operations on some accessible data, and the ability to cause the product to hang or crash repeatedly, leading to denial of service. The vulnerability impacts confidentiality, integrity, and availability with high confidentiality and availability impact and low integrity impact.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers running version 11.4.0 of Oracle Commerce Guided Search / Oracle Commerce Experience Manager should apply the relevant patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this and other vulnerabilities.