CVE-2026-83243

CVE-2026-83243 is an easily exploitable information disclosure flaw in the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. A remote attacker with only low-privilege (authenticated) access to the product over HTTP can trigger the flaw and gain unauthorized access to critical data, up to complete access to all data reachable by Oracle Commerce Guided Search / Experience Manager. The CVSS 3.1 base score is 7.7 (high), driven by a high confidentiality impact with a scope change, meaning successful attacks may also expose data in additional products beyond the vulnerable component. Organizations running the affected 11.4.0 release of Oracle Commerce Guided Search / Experience Manager are exposed, particularly where low-privilege accounts or the Experience Manager authoring interface are reachable over the network. There is no known public proof of concept, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that resolves this CVE to Oracle Commerce 11.4.0 as soon as possible. Restrict network access to the Experience Manager authoring/admin interfaces via HTTP to trusted IPs or VPN only, and review low-privilege accounts for necessity and signs of misuse. Audit access logs for unusual reads of sensitive data by low-privilege users, since the flaw may also expose data in products beyond the vulnerable component.