Threat Intelligence Database

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It allows an unauthenticated attacker with physical access to the communication segment of the hardware running the product to potentially gain unauthorized access to critical data, perform unauthorized data modifications, or cause denial of service through hangs or crashes. The vulnerability is rated with a CVSS 3.1 base score of 7.1, indicating high severity.

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It is a difficult to exploit flaw that allows an unauthenticated attacker with network access via HTTP to potentially take over the affected product. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for this and many other vulnerabilities.

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical data or cause a partial denial of service. The vulnerability is rated with a CVSS 3.1 base score of 6.5, indicating medium severity with confidentiality and availability impacts.

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0, specifically in the Endeca Application Controller component. This vulnerability allows an unauthenticated attacker with access to the infrastructure where the product runs to potentially take over the application. Exploitation requires user interaction by a person other than the attacker. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 addressing this and many other vulnerabilities.

CVE-2026-83247 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It allows an unauthenticated attacker with access to the infrastructure where the product runs to potentially take over the application. Exploitation requires user interaction by someone other than the attacker. The vulnerability has a high CVSS score of 7.8, indicating significant confidentiality, integrity, and availability impacts.

CVE-2026-83248 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. It allows an unauthenticated attacker with network access via HTTP to cause a denial of service (hang or crash) and gain unauthorized read access to some accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with confidentiality and availability impacts. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update.

CVE-2026-83246 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It allows a difficult-to-exploit, unauthenticated attacker with network access via HTTP to potentially take over the affected product. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. This flaw allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data and potentially cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with impacts primarily on confidentiality and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected products including this version. Users are strongly advised to apply the official patches promptly to mitigate risk.

A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller component) version 11.4.0. It allows a low privileged attacker with logon access to the infrastructure to potentially take over the affected product. The vulnerability has a CVSS 3.1 base score of 7.0, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for this and many other vulnerabilities.

CVE-2026-83241 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It allows an unauthenticated attacker with network access via HTTP to potentially take over the affected product. Exploitation requires human interaction from a user other than the attacker. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.