CVE-2026-83242

CVE-2026-83242 is a high-severity (CVSS 7.3) vulnerability in the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, affecting the supported version 11.4.0. It is easily exploitable by an unauthenticated attacker with network access over HTTP, requiring no privileges or user interaction. A successful attack lets the attacker gain unauthorized update, insert, and delete access to some of the product's accessible data, unauthorized read access to a subset of that data, and the ability to cause a partial denial of service. Organizations running the affected on-premises commerce search/personalization product are exposed wherever its HTTP endpoints are reachable, particularly if the Experience Manager interface is internet-facing. No public proof of concept is known, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates this issue to all Oracle Commerce Guided Search / Experience Manager 11.4.0 deployments as soon as it is available. In the interim, restrict network access to Experience Manager and related HTTP endpoints (e.g., via firewall rules or VPN) so they are not reachable from untrusted networks, and inspect access logs for unauthenticated requests targeting the Experience Manager component. Verify that no other Oracle Commerce deployments in your environment are running the affected 11.4.0 version.