CVE-2026-83253

Received Received - Intake

Unauthenticated Takeover in Oracle Commerce Guided Search

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83253

EUVD

EUVD-2026-79605

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	commerce_guided_search	11.4.0
oracle	commerce_experience_manager	11.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Commerce Guided Search and Oracle Commerce Experience Manager version 11.4.0. It allows an unauthenticated attacker with local system access to potentially take over the system. The attack requires another person to interact with the system, but once exploited, it can lead to full system compromise with high impacts on confidentiality, integrity, and availability.

Detection Guidance

This vulnerability affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. Detection requires checking for the presence of this specific version and verifying if the Endeca Application Controller component is exposed. No specific commands are provided in the context, but you should inspect running services and installed software versions on systems running Oracle Commerce.

Impact Analysis

If you use Oracle Commerce Guided Search or Experience Manager 11.4.0, an attacker could gain control of your system. This could lead to data theft, unauthorized changes, or system disruption. The attack requires local access but could result in complete takeover of the affected software.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate GDPR and HIPAA requirements for data protection and access controls. A successful exploit could result in loss of sensitive data, leading to potential compliance violations and regulatory penalties.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0. Restrict access to the infrastructure where the product executes to trusted users only. Monitor for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-83253. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70