Technology · Oracle
Oracle Commerce Guided Search vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 104 vulnerabilities in Oracle Commerce Guided Search: 0 in the last 7 days and 86 in the last 90 days, 21 of them critical and 1 exploited in the wild. The most recent, CVE-2026-83259, was published on 15 September 2026. Nothing in the last four weeks, down from 25 vulnerabilities in the four before.
- Last 7 days
- 0
- Last 90 days
- 86
- Critical, all time
- 21
- Exploited in the wild
- 1
About Oracle Commerce Guided Search
Oracle Commerce library providing search guidance and personalization capabilities.
Latest Oracle Commerce Guided Search vulnerabilities
- CVE-2026-83259: Oracle Commerce Guided Search access control weakness in ForgehighCVSS 7.1EPSS 0.4%
- CVE-2026-83258: Oracle Commerce Guided Search and Experience Manager remote compromise in ForgehighCVSS 8.1EPSS 0.4%
- CVE-2026-83257: Oracle Commerce Guided Search privilege escalation in ForgehighCVSS 7.5EPSS 0.3%
- CVE-2026-83256: Oracle Commerce Guided Search remote code executionhighCVSS 8.1EPSS 0.4%
- CVE-2026-83255: Oracle Commerce Guided Search / Experience Manager remote code executionhighCVSS 8.1EPSS 0.4%
- CVE-2026-83254: Oracle Commerce Guided Search and Experience Manager arbitrary code execution in ForgehighCVSS 8.1EPSS 0.4%
- CVE-2026-83253: Oracle Commerce Guided Search privilege escalation in Endeca Application ControllerhighCVSS 7.8EPSS 0.2%
- CVE-2026-83252: Oracle Commerce Guided Search authentication bypasshighCVSS 7EPSS 0.3%
- CVE-2026-83251: Oracle Commerce Guided Search denial of service and information disclosuremediumCVSS 6.5EPSS 0.3%
- CVE-2026-83250: Oracle Commerce Guided Search remote access vulnerability in ForgemediumCVSS 6.5EPSS 0.3%
- CVE-2026-83249: Oracle Commerce Guided Search privilege escalation in ForgehighCVSS 7.8EPSS 0.1%
- CVE-2026-83248: Oracle Commerce Guided Search denial of service and information disclosurehighCVSS 8.2EPSS 0.4%
- CVE-2026-83247: Oracle Commerce Guided Search remote code execution in ForgehighCVSS 7.8EPSS 0.2%
- CVE-2026-83246: Oracle Commerce Guided Search and Experience Manager remote code executionhighCVSS 8.1EPSS 0.4%
- CVE-2026-83245: Oracle Commerce Guided Search remote code executionhighCVSS 8.1EPSS 0.4%
- CVE-2026-83244: Oracle Commerce Guided Search arbitrary access in ForgehighCVSS 7.1EPSS 0.2%
- CVE-2026-83242: Oracle Commerce Guided Search data access vulnerabilityhighCVSS 7.3EPSS 0.3%
- CVE-2026-83241: Oracle Commerce Guided Search and Experience Manager code execution in ForgehighCVSS 7.5EPSS 0.3%
- CVE-2026-83240: Oracle Commerce Guided Search privilege escalation in ForgehighCVSS 7.1EPSS 0.1%
- CVE-2026-83239: Oracle Commerce Guided Search privilege escalation in Endeca Application ControllerhighCVSS 7EPSS 0.1%
- CVE-2026-83238: Oracle Commerce Guided Search privilege escalation in ForgehighCVSS 7.1EPSS 0.4%
- CVE-2026-83237: Oracle Commerce Guided Search authentication bypass in ForgehighCVSS 7.1EPSS 0.4%
- CVE-2026-83236: Oracle Commerce Guided Search cross-site request forgeryhighCVSS 8.2EPSS 0.3%
- CVE-2026-83235: Oracle Commerce Guided Search authentication bypasshighCVSS 7.5EPSS 0.4%
- CVE-2026-83234: Oracle Commerce Guided Search / Experience Manager authentication bypasshighCVSS 8.2EPSS 0.3%
Most severe Oracle Commerce Guided Search vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2022-22947: Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecuredcriticalexploited in the wildCVSS 3.1EPSS 98.3%
- CVE-2026-61146: Oracle Commerce Guided Search compromise in Content Acquisition SystemcriticalCVSS 9.9
- CVE-2026-70995: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce…criticalCVSS 9.8EPSS 0.5%
- CVE-2026-61161: Oracle Commerce Guided Search compromise in Endeca Application ControllercriticalCVSS 9.8
- CVE-2026-61145: Oracle Commerce Guided Search takeover in Content Acquisition SystemcriticalCVSS 9.8
- CVE-2026-71037: Oracle Commerce Guided Search remote code execution via HTTPcriticalCVSS 9.3EPSS 0.4%
- CVE-2026-70998: Oracle Commerce Guided Search remote unauthenticated data accesscriticalCVSS 9.3EPSS 0.4%
- CVE-2026-70997: Oracle Commerce Guided Search remote data access and denial of servicecriticalCVSS 9.1EPSS 0.5%
- CVE-2026-70994: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce…criticalCVSS 9.1EPSS 0.5%
- CVE-2026-70984: Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce…criticalCVSS 9.1EPSS 0.4%
Vulnerabilities per week
Nothing in the last four weeks, down from 25 vulnerabilities in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 61 | 16 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 25 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Oracle Commerce Guided Search vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/commerce-guided-search)<a href="https://junglewise.ai/threats/technologies/commerce-guided-search"><img src="https://junglewise.ai/threats/technologies/commerce-guided-search/badge.svg" alt="Oracle Commerce Guided Search vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/commerce-guided-search.json, and this page as text at https://junglewise.ai/threats/technologies/commerce-guided-search.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Oracle Commerce Guided Search vulnerabilities", https://junglewise.ai/threats/technologies/commerce-guided-search, 9 November 2026.