{"schema_version":1,"title":"Oracle Commerce Experience Manager vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 81 vulnerabilities in Oracle Commerce Experience Manager: 0 in the last 7 days and 81 in the last 90 days, 10 of them critical and 0 exploited in the wild. The most recent, CVE-2026-83259, was published on 15 September 2026.","url":"https://junglewise.ai/threats/technologies/commerce-experience-manager","json_url":"https://junglewise.ai/threats/technologies/commerce-experience-manager.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/commerce-experience-manager","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":55,"all_time":81,"critical":10,"exploited":0,"last_7_days":0,"last_30_days":26,"last_90_days":81,"last_365_days":81},"latest":[{"cve":"CVE-2026-83259","cvss":7.1,"epss":0.004,"slug":"cve-2026-83259-oracle-commerce-guided-search-access-control-weakness-in-forge","title":"Oracle Commerce Guided Search access control weakness in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:38.183+00:00","url":"https://junglewise.ai/threats/cve-2026-83259-oracle-commerce-guided-search-access-control-weakness-in-forge"},{"cve":"CVE-2026-83258","cvss":8.1,"epss":0.0037,"slug":"cve-2026-83258-oracle-commerce-guided-search-and-experience-manager-remote","title":"Oracle Commerce Guided Search and Experience Manager remote compromise in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:38.073+00:00","url":"https://junglewise.ai/threats/cve-2026-83258-oracle-commerce-guided-search-and-experience-manager-remote"},{"cve":"CVE-2026-83257","cvss":7.5,"epss":0.0032,"slug":"cve-2026-83257-oracle-commerce-guided-search-privilege-escalation-in-forge","title":"Oracle Commerce Guided Search privilege escalation in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:37.97+00:00","url":"https://junglewise.ai/threats/cve-2026-83257-oracle-commerce-guided-search-privilege-escalation-in-forge"},{"cve":"CVE-2026-83256","cvss":8.1,"epss":0.0037,"slug":"cve-2026-83256-oracle-commerce-guided-search-remote-code-execution","title":"Oracle Commerce Guided Search remote code execution","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:37.86+00:00","url":"https://junglewise.ai/threats/cve-2026-83256-oracle-commerce-guided-search-remote-code-execution"},{"cve":"CVE-2026-83255","cvss":8.1,"epss":0.0037,"slug":"cve-2026-83255-oracle-commerce-guided-search-experience-manager-remote-code","title":"Oracle Commerce Guided Search / Experience Manager remote code execution","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:37.75+00:00","url":"https://junglewise.ai/threats/cve-2026-83255-oracle-commerce-guided-search-experience-manager-remote-code"},{"cve":"CVE-2026-83254","cvss":8.1,"epss":0.0037,"slug":"cve-2026-83254-oracle-commerce-guided-search-and-experience-manager-arbitrary","title":"Oracle Commerce Guided Search and Experience Manager arbitrary code execution in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:37.643+00:00","url":"https://junglewise.ai/threats/cve-2026-83254-oracle-commerce-guided-search-and-experience-manager-arbitrary"},{"cve":"CVE-2026-83253","cvss":7.8,"epss":0.0016,"slug":"cve-2026-83253-oracle-commerce-guided-search-privilege-escalation-in-endeca","title":"Oracle Commerce Guided Search privilege escalation in Endeca Application Controller","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:37.533+00:00","url":"https://junglewise.ai/threats/cve-2026-83253-oracle-commerce-guided-search-privilege-escalation-in-endeca"},{"cve":"CVE-2026-83252","cvss":7,"epss":0.0028,"slug":"cve-2026-83252-oracle-commerce-guided-search-authentication-bypass","title":"Oracle Commerce Guided Search authentication bypass","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:37.417+00:00","url":"https://junglewise.ai/threats/cve-2026-83252-oracle-commerce-guided-search-authentication-bypass"},{"cve":"CVE-2026-83251","cvss":6.5,"epss":0.0034,"slug":"cve-2026-83251-oracle-commerce-guided-search-denial-of-service-and-information","title":"Oracle Commerce Guided Search denial of service and information disclosure","severity":"medium","exploited":false,"published_at":"2026-09-15T20:18:37.307+00:00","url":"https://junglewise.ai/threats/cve-2026-83251-oracle-commerce-guided-search-denial-of-service-and-information"},{"cve":"CVE-2026-83250","cvss":6.5,"epss":0.0033,"slug":"cve-2026-83250-oracle-commerce-guided-search-remote-access-vulnerability-in","title":"Oracle Commerce Guided Search remote access vulnerability in Forge","severity":"medium","exploited":false,"published_at":"2026-09-15T20:18:37.193+00:00","url":"https://junglewise.ai/threats/cve-2026-83250-oracle-commerce-guided-search-remote-access-vulnerability-in"},{"cve":"CVE-2026-83249","cvss":7.8,"epss":0.0012,"slug":"cve-2026-83249-oracle-commerce-guided-search-privilege-escalation-in-forge","title":"Oracle Commerce Guided Search privilege escalation in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:37.08+00:00","url":"https://junglewise.ai/threats/cve-2026-83249-oracle-commerce-guided-search-privilege-escalation-in-forge"},{"cve":"CVE-2026-83248","cvss":8.2,"epss":0.0043,"slug":"cve-2026-83248-oracle-commerce-guided-search-denial-of-service-and-information","title":"Oracle Commerce Guided Search denial of service and information disclosure","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:36.963+00:00","url":"https://junglewise.ai/threats/cve-2026-83248-oracle-commerce-guided-search-denial-of-service-and-information"},{"cve":"CVE-2026-83247","cvss":7.8,"epss":0.0016,"slug":"cve-2026-83247-oracle-commerce-guided-search-remote-code-execution-in-forge","title":"Oracle Commerce Guided Search remote code execution in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:36.853+00:00","url":"https://junglewise.ai/threats/cve-2026-83247-oracle-commerce-guided-search-remote-code-execution-in-forge"},{"cve":"CVE-2026-83246","cvss":8.1,"epss":0.0037,"slug":"cve-2026-83246-oracle-commerce-guided-search-and-experience-manager-remote-code","title":"Oracle Commerce Guided Search and Experience Manager remote code execution","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:36.733+00:00","url":"https://junglewise.ai/threats/cve-2026-83246-oracle-commerce-guided-search-and-experience-manager-remote-code"},{"cve":"CVE-2026-83245","cvss":8.1,"epss":0.0037,"slug":"cve-2026-83245-oracle-commerce-guided-search-remote-code-execution","title":"Oracle Commerce Guided Search remote code execution","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:36.597+00:00","url":"https://junglewise.ai/threats/cve-2026-83245-oracle-commerce-guided-search-remote-code-execution"},{"cve":"CVE-2026-83244","cvss":7.1,"epss":0.0021,"slug":"cve-2026-83244-oracle-commerce-guided-search-arbitrary-access-in-forge","title":"Oracle Commerce Guided Search arbitrary access in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:36.48+00:00","url":"https://junglewise.ai/threats/cve-2026-83244-oracle-commerce-guided-search-arbitrary-access-in-forge"},{"cve":"CVE-2026-83243","cvss":7.7,"epss":0.0034,"slug":"cve-2026-83243-oracle-commerce-experience-manager-unauthorized-data-access","title":"Oracle Commerce Experience Manager unauthorized data access","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:36.353+00:00","url":"https://junglewise.ai/threats/cve-2026-83243-oracle-commerce-experience-manager-unauthorized-data-access"},{"cve":"CVE-2026-83242","cvss":7.3,"epss":0.003,"slug":"cve-2026-83242-oracle-commerce-guided-search-data-access-vulnerability","title":"Oracle Commerce Guided Search data access vulnerability","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:36.24+00:00","url":"https://junglewise.ai/threats/cve-2026-83242-oracle-commerce-guided-search-data-access-vulnerability"},{"cve":"CVE-2026-83241","cvss":7.5,"epss":0.0031,"slug":"cve-2026-83241-oracle-commerce-guided-search-and-experience-manager-code","title":"Oracle Commerce Guided Search and Experience Manager code execution in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:36.13+00:00","url":"https://junglewise.ai/threats/cve-2026-83241-oracle-commerce-guided-search-and-experience-manager-code"},{"cve":"CVE-2026-83240","cvss":7.1,"epss":0.0013,"slug":"cve-2026-83240-oracle-commerce-guided-search-privilege-escalation-in-forge","title":"Oracle Commerce Guided Search privilege escalation in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:36.017+00:00","url":"https://junglewise.ai/threats/cve-2026-83240-oracle-commerce-guided-search-privilege-escalation-in-forge"},{"cve":"CVE-2026-83239","cvss":7,"epss":0.0012,"slug":"cve-2026-83239-oracle-commerce-guided-search-privilege-escalation-in-endeca","title":"Oracle Commerce Guided Search privilege escalation in Endeca Application Controller","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:35.91+00:00","url":"https://junglewise.ai/threats/cve-2026-83239-oracle-commerce-guided-search-privilege-escalation-in-endeca"},{"cve":"CVE-2026-83238","cvss":7.1,"epss":0.004,"slug":"cve-2026-83238-oracle-commerce-guided-search-privilege-escalation-in-forge","title":"Oracle Commerce Guided Search privilege escalation in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:35.8+00:00","url":"https://junglewise.ai/threats/cve-2026-83238-oracle-commerce-guided-search-privilege-escalation-in-forge"},{"cve":"CVE-2026-83237","cvss":7.1,"epss":0.004,"slug":"cve-2026-83237-oracle-commerce-guided-search-authentication-bypass-in-forge","title":"Oracle Commerce Guided Search authentication bypass in Forge","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:35.69+00:00","url":"https://junglewise.ai/threats/cve-2026-83237-oracle-commerce-guided-search-authentication-bypass-in-forge"},{"cve":"CVE-2026-83235","cvss":7.5,"epss":0.0039,"slug":"cve-2026-83235-oracle-commerce-guided-search-authentication-bypass","title":"Oracle Commerce Guided Search authentication bypass","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:35.46+00:00","url":"https://junglewise.ai/threats/cve-2026-83235-oracle-commerce-guided-search-authentication-bypass"},{"cve":"CVE-2026-83234","cvss":8.2,"epss":0.0034,"slug":"cve-2026-83234-oracle-commerce-guided-search-experience-manager-authentication","title":"Oracle Commerce Guided Search / Experience Manager authentication bypass","severity":"high","exploited":false,"published_at":"2026-09-15T20:18:35.34+00:00","url":"https://junglewise.ai/threats/cve-2026-83234-oracle-commerce-guided-search-experience-manager-authentication"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":3,"exploited":0,"vulnerabilities":15},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":7,"exploited":0,"vulnerabilities":40},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":26},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Oracle Hyperion Financial Management","slug":"hyperion-financial-management","vulnerabilities":129,"url":"https://junglewise.ai/threats/technologies/hyperion-financial-management"},{"name":"Oracle Coherence","slug":"coherence","vulnerabilities":113,"url":"https://junglewise.ai/threats/technologies/coherence"},{"name":"Oracle E-Business Suite","slug":"e-business-suite","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/e-business-suite"},{"name":"Oracle Commerce Guided Search","slug":"commerce-guided-search","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/commerce-guided-search"},{"name":"Oracle WebCenter Content","slug":"webcenter-content","vulnerabilities":73,"url":"https://junglewise.ai/threats/technologies/webcenter-content"},{"name":"Oracle VirtualBox","slug":"virtualbox","vulnerabilities":70,"url":"https://junglewise.ai/threats/technologies/virtualbox"},{"name":"Oracle Helidon","slug":"helidon","vulnerabilities":68,"url":"https://junglewise.ai/threats/technologies/helidon"},{"name":"Oracle MySQL Server","slug":"mysql-server","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/mysql-server"},{"name":"Oracle Hyperion Data Relationship Management","slug":"hyperion-data-relationship-management","vulnerabilities":56,"url":"https://junglewise.ai/threats/technologies/hyperion-data-relationship-management"},{"name":"Oracle WebLogic Server","slug":"weblogic-server","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/weblogic-server"},{"name":"Oracle Java SE","slug":"java-se","vulnerabilities":52,"url":"https://junglewise.ai/threats/technologies/java-se"},{"name":"Oracle MySQL Cluster","slug":"mysql-cluster","vulnerabilities":49,"url":"https://junglewise.ai/threats/technologies/mysql-cluster"}],"technology":{"hub":true,"name":"Oracle Commerce Experience Manager","slug":"commerce-experience-manager","vendor":{"name":"Oracle","slug":"oracle","url":"https://junglewise.ai/threats/vendors/oracle"},"aliases":[],"category":"cms","homepage":"https://www.oracle.com/cx/commerce/","description":"A content management application used to create and manage personalized customer experiences across digital commerce channels.","url":"https://junglewise.ai/threats/technologies/commerce-experience-manager"},"most_severe":[{"cve":"CVE-2026-61146","cvss":9.9,"slug":"cve-2026-61146-oracle-commerce-guided-search-compromise-in-content-acquisition","title":"Oracle Commerce Guided Search compromise in Content Acquisition System","severity":"critical","exploited":false,"published_at":"2026-07-21T22:18:45.99+00:00","url":"https://junglewise.ai/threats/cve-2026-61146-oracle-commerce-guided-search-compromise-in-content-acquisition"},{"cve":"CVE-2026-61161","cvss":9.8,"slug":"cve-2026-61161-oracle-commerce-guided-search-compromise-in-endeca-application","title":"Oracle Commerce Guided Search compromise in Endeca Application Controller","severity":"critical","exploited":false,"published_at":"2026-07-21T22:18:47.687+00:00","url":"https://junglewise.ai/threats/cve-2026-61161-oracle-commerce-guided-search-compromise-in-endeca-application"},{"cve":"CVE-2026-61145","cvss":9.8,"slug":"cve-2026-61145-oracle-commerce-guided-search-takeover-in-content-acquisition","title":"Oracle Commerce Guided Search takeover in Content Acquisition System","severity":"critical","exploited":false,"published_at":"2026-07-21T22:18:45.88+00:00","url":"https://junglewise.ai/threats/cve-2026-61145-oracle-commerce-guided-search-takeover-in-content-acquisition"},{"cve":"CVE-2026-71037","cvss":9.3,"epss":0.0038,"slug":"cve-2026-71037-oracle-commerce-guided-search-remote-code-execution-via-http","title":"Oracle Commerce Guided Search remote code execution via HTTP","severity":"critical","exploited":false,"published_at":"2026-08-18T21:18:03.427+00:00","url":"https://junglewise.ai/threats/cve-2026-71037-oracle-commerce-guided-search-remote-code-execution-via-http"},{"cve":"CVE-2026-70998","cvss":9.3,"epss":0.0035,"slug":"cve-2026-70998-oracle-commerce-guided-search-remote-unauthenticated-data-access","title":"Oracle Commerce Guided Search remote unauthenticated data access","severity":"critical","exploited":false,"published_at":"2026-08-18T21:17:58.883+00:00","url":"https://junglewise.ai/threats/cve-2026-70998-oracle-commerce-guided-search-remote-unauthenticated-data-access"},{"cve":"CVE-2026-70997","cvss":9.1,"epss":0.0049,"slug":"cve-2026-70997-oracle-commerce-guided-search-remote-data-access-and-denial-of","title":"Oracle Commerce Guided Search remote data access and denial of service","severity":"critical","exploited":false,"published_at":"2026-08-18T21:17:58.767+00:00","url":"https://junglewise.ai/threats/cve-2026-70997-oracle-commerce-guided-search-remote-data-access-and-denial-of"},{"cve":"CVE-2026-71036","cvss":9.1,"epss":0.0043,"slug":"cve-2026-71036-oracle-commerce-experience-manager-unauthorized-data-access","title":"Oracle Commerce Experience Manager unauthorized data access","severity":"critical","exploited":false,"published_at":"2026-08-18T21:18:03.313+00:00","url":"https://junglewise.ai/threats/cve-2026-71036-oracle-commerce-experience-manager-unauthorized-data-access"},{"cve":"CVE-2026-71026","cvss":9.1,"epss":0.0043,"slug":"cve-2026-71026-oracle-commerce-guided-search-remote-data-access-vulnerability","title":"Oracle Commerce Guided Search remote data access vulnerability","severity":"critical","exploited":false,"published_at":"2026-08-18T21:18:02.16+00:00","url":"https://junglewise.ai/threats/cve-2026-71026-oracle-commerce-guided-search-remote-data-access-vulnerability"},{"cve":"CVE-2026-71015","cvss":9.1,"epss":0.0043,"slug":"cve-2026-71015-oracle-commerce-guided-search-authentication-bypass","title":"Oracle Commerce Guided Search authentication bypass","severity":"critical","exploited":false,"published_at":"2026-08-18T21:18:00.877+00:00","url":"https://junglewise.ai/threats/cve-2026-71015-oracle-commerce-guided-search-authentication-bypass"},{"cve":"CVE-2026-71014","cvss":9.1,"epss":0.0043,"slug":"cve-2026-71014-oracle-commerce-guided-search-authentication-bypass-via-endeca","title":"Oracle Commerce Guided Search authentication bypass via Endeca","severity":"critical","exploited":false,"published_at":"2026-08-18T21:18:00.763+00:00","url":"https://junglewise.ai/threats/cve-2026-71014-oracle-commerce-guided-search-authentication-bypass-via-endeca"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}