CVE-2026-83238

CVE-2026-83238 is an easily exploitable flaw in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, affecting version 11.4.0. A low-privileged attacker with network access via HTTP can trigger the flaw to gain unauthorized access to critical data — up to complete access to all data the product can reach — and to cause a partial denial of service. The vulnerability carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), with high confidentiality and low availability impact and no integrity impact. Organizations running Oracle Commerce (formerly Endeca) search deployments on the affected version are exposed wherever the Forge service is reachable by low-privilege or application-level accounts. There is no evidence of exploitation in the wild: the CVE is not in CISA's KEV catalog and no public proof of concept is known.

What to do: Apply the Oracle Critical Patch Update that remediated CVE-2026-83238 as soon as possible, as Oracle typically only patches the latest release of this product. Restrict network and HTTP access to the Forge component to trusted administrators and application hosts so low-privilege users cannot reach it. Audit Forge service logs for anomalous data reads or repeated requests indicative of attempted data harvesting or partial DoS.