CVE-2026-83250 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially resulting in unauthorized access to critical data or partial denial of service. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, reflecting network attack vector, high attack complexity, no privileges or user interaction required, with high confidentiality impact and low availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update advisory, recommending customers apply patches promptly. However, the vendor advisory does not explicitly confirm the availability of a patch for this specific version or vulnerability.

Successful exploitation can lead to unauthorized access to critical data within Oracle Commerce Guided Search / Oracle Commerce Experience Manager and the ability to cause a partial denial of service. The confidentiality impact is high, and availability impact is low. There is no indication of integrity impact. The vulnerability requires network access but has high attack complexity and does not require privileges or user interaction.

Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. This vulnerability is included in the September 2026 Critical Security Patch Update, which contains numerous fixes across Oracle products. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and installation instructions. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, customers should verify the latest patch information from Oracle. No vendor advisory states that no action is required or that the vulnerability is already mitigated.