Threat Intelligence Database

CVE-2026-83247 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It allows an unauthenticated attacker with access to the infrastructure where the product runs to potentially take over the application. Exploitation requires user interaction by someone other than the attacker. The vulnerability has a high CVSS score of 7.8, indicating significant confidentiality, integrity, and availability impacts.

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. Successful exploitation can lead to complete access to all accessible data within the affected component. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security fixes. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk.

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This flaw allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data and potentially cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with impacts primarily on confidentiality and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected products including this version. Users are strongly advised to apply the official patches promptly to mitigate risk.

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 that allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical data and perform unauthorized data modifications. Exploitation requires user interaction from a person other than the attacker. The vulnerability has a high CVSS score of 8.2, indicating significant confidentiality and integrity impacts. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected products including Oracle Commerce Experience Manager.

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 that allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with a significant confidentiality impact. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update, which includes targeted patches for this and many other vulnerabilities.

A vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized data modifications. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with significant confidentiality and integrity impacts. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update.

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity, with a confidentiality impact and scope change affecting additional products. Oracle has released a Critical Security Patch Update including fixes for this and many other vulnerabilities.

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

CVE-2026-71038 is a high-severity vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within the affected product. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring user interaction or privileges.

CVE-2026-71037 is a critical vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation requires human interaction from a person other than the attacker and may impact additional Oracle Commerce products. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data and complete access to all accessible data within the affected product.