Executive brief
Oracle Commerce Guided Search and Oracle Commerce Experience Manager are e-commerce platform components used to deliver product search and personalized shopping experiences. A vulnerability in the Forge component allows unauthenticated attackers on the network to take complete control of these systems, compromising customer data, order information, and the integrity of the shopping platform.
Technical details
This is a difficult-to-exploit network-reachable vulnerability in the Forge component of Oracle Commerce Guided Search and Experience Manager that requires no authentication or user interaction. The flaw allows unauthenticated attackers with TCP network access to achieve complete system compromise, resulting in confidentiality, integrity, and availability impacts. While no public exploit details are currently available, the high CVSS score (8.1) and full-system compromise capability suggest a critical business risk. Patches are expected from Oracle as part of their standard security update cycle.
Affected products
- Oracle Commerce Guided Search 11.4.0
- Oracle Commerce Experience Manager 11.4.0
Timeline
- 2026-09-15: disclosed