CVE-2026-83236

CVE-2026-83236 is an easily exploitable vulnerability in the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, affecting supported version 11.4.0. It is triggered over the network via HTTP by an unauthenticated attacker, but successful exploitation requires interaction from a victim user (e.g., visiting a crafted page), and the CVSS vector's scope change indicates impacts can extend beyond the vulnerable component into additional products. A successful attack can give the attacker unauthorized access to critical data or complete access to all data accessible to the application, plus unauthorized update, insert, or delete access to some of that data (high confidentiality and low integrity impact, no availability impact). Organizations running Oracle Commerce Guided Search / Experience Manager 11.4.0, typically large enterprise e-commerce deployments, are affected. No public proof of concept is known and the flaw is not on the CISA KEV catalog, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83236 to your Oracle Commerce Guided Search / Experience Manager 11.4.0 environment as soon as it is available, and verify you are on the patched release referenced in Oracle's advisory (do not assume other versions are safe without checking the CPU notes). Restrict network access to the Experience Manager console and admin endpoints so they are reachable only from trusted networks or via VPN, since the flaw is exploitable unauthenticated over HTTP. Review access logs around the Experience Manager component for anomalous unauthenticated requests or unexpected data access/modification as an indicator of prior abuse.