A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. This vulnerability allows an unauthenticated attacker with network access via HTTP to potentially take over the affected product. The vulnerability is rated with a CVSS 3.1 base score of 8.1, indicating high severity with impacts on confidentiality, integrity, and availability.
A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It allows a low privileged attacker with network access via HTTP to potentially take over the affected product. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 that addresses this and many other vulnerabilities.
CVE-2026-83251 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It allows an unauthenticated attacker with network access via TLS to cause a denial of service (hang or repeated crash) and gain unauthorized read access to some accessible data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity with impacts on confidentiality and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, recommending customers apply patches promptly.
CVE-2026-83255 is a vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It allows an unauthenticated attacker with network access via TCP to potentially take over the affected product. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.
A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical data, perform unauthorized data modifications, and cause partial denial of service. The vulnerability is rated with a CVSS 3.1 base score of 7.0, indicating high severity.
A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It is a network-accessible vulnerability that is difficult to exploit but can allow an unauthenticated attacker to compromise the product, potentially leading to full takeover. The vulnerability has a high CVSS 3.1 base score of 8.1, indicating severe confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides security patches for affected products.
A vulnerability exists in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge) version 11.4.0. It is a difficult to exploit flaw that requires a low privileged attacker with logon access to the infrastructure. Successful exploitation can lead to full takeover of the affected product and may impact additional Oracle Commerce products. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, providing patches to remediate the issue.