Is CVE-2026-83253 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83253 being exploited in the wild.

How severe is CVE-2026-83253?

High severity, with a CVSS score of 7.8, published 15 September 2026.

Which products and versions are affected?

Oracle Commerce Experience Manager 11.4.0; Oracle Commerce Guided Search 11.4.0.

Is there a fix for CVE-2026-83253?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-83253 attacked?

It is attacked with local access.

Am I affected by CVE-2026-83253?

Check whether you run Oracle Commerce Experience Manager or Oracle Commerce Guided Search at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83253: Oracle Commerce Guided Search privilege escalation in Endeca Application Controller

CVE-2026-83253 · Severity: high · CVSS 7.8 · Published 2026-09-15

Oracle Commerce Guided Search and Experience Manager are components used to power product search and discovery in e-commerce platforms. A vulnerability in the Endeca Application Controller allows an authenticated local attacker to gain complete control of the system, requiring user interaction to exploit. Successful compromise could lead to unauthorized access to customer data, modification of search results or pricing, and service disruption.

Technologies: Oracle Commerce Experience Manager, Oracle Commerce Guided Search. Vendors: Oracle.

Quick answers

Is CVE-2026-83253 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83253 being exploited in the wild.
How severe is CVE-2026-83253?: High severity, with a CVSS score of 7.8, published 15 September 2026.
Which products and versions are affected?: Oracle Commerce Experience Manager 11.4.0; Oracle Commerce Guided Search 11.4.0.
Is there a fix for CVE-2026-83253?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-83253 attacked?: It is attacked with local access.
Am I affected by CVE-2026-83253?: Check whether you run Oracle Commerce Experience Manager or Oracle Commerce Guided Search at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a local privilege escalation vulnerability affecting the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. The vulnerability requires an unauthenticated attacker with local access to the infrastructure and requires user interaction from another party to successfully exploit. The attack results in complete system compromise (confidentiality, integrity, and availability impacts). The vulnerability has a CVSS 3.1 score of 7.8 with a local attack vector (AV:L), low attack complexity (AC:L), no privilege requirements (PR:N), and requires user interaction (UI:R).

Affected products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0

Timeline

2026-09-15: disclosed: Vulnerability announced by Oracle

References

https://www.oracle.com/security-alerts/cspusep2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.