CVE-2026-83246

A vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager allows an unauthenticated remote attacker with HTTP network access to fully compromise the affected product, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). Oracle rates the vulnerability as difficult to exploit (attack complexity: high), meaning an attacker would need favorable conditions or significant preparation, but no authentication, user interaction, or privileges are required. Successful exploitation results in complete takeover of the Guided Search / Experience Manager installation. Only the supported version 11.4.0 is listed as affected. There is no known public proof of concept, no confirmed in-the-wild exploitation, and the flaw is not on the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83246 to all Oracle Commerce Guided Search / Experience Manager 11.4.0 installations as soon as it is available. Verify that Forge and other backend Guided Search services are not exposed to the public internet or untrusted networks — restrict access via firewall rules to known indexing and application hosts. Monitor HTTP access logs to Forge endpoints for unexpected unauthenticated requests and anomalous behavior until the patch is applied.