CVE-2026-83248

Oracle discloses an easily exploitable vulnerability in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, with supported version 11.4.0 affected. An unauthenticated attacker with network access via HTTP — requiring no privileges or user interaction — can trigger the flaw. Successful exploitation results in unauthorized ability to hang or repeatedly crash the service (complete denial of service) as well as unauthorized read access to a subset of data accessible to the product. The issue carries a CVSS 3.1 base score of 8.2 (high), driven by high availability impact and low confidentiality impact. No public proof of concept is known, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE as soon as possible, as Oracle ships fixes for this product only through its quarterly CPU process. Until patched, restrict HTTP access to Forge and Guided Search / Experience Manager endpoints to trusted hosts using firewall rules or network segmentation. Monitor Forge services for unexplained hangs, crashes, or anomalous data-read requests, and confirm whether version 11.4.0 is deployed in your environment.