EUVD-2026-47364
GHSA-x7qw-hr43-c7jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Platform Services HTTPS endpoint
-
DeliverySend crafted request bypassing authentication
-
ExploitInvoke privileged Forge/Platform Services operations
-
ExecutionRead or tamper with all accessible data
-
ImpactExfiltrate and modify critical catalog data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Oracle Commerce Guided Search Platform Services HTTPS interface (the Forge component) of a version 11.4.0 deployment; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity, so against a reachable default instance no further special conditions apply. The primary limiting factor is exposure: the service is a back-office Endeca/Commerce component that is often deployed on internal networks, so realistic risk is highest where the endpoint is internet-facing or reachable from a compromised network segment, and lowest where it is firewalled to a management VLAN. Only version 11.4.0 is confirmed affected, which further bounds the exposed population. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a genuinely high-priority network-reachable flaw: no privileges, no user interaction, low complexity, with full confidentiality and integrity loss but no availability impact - consistent with data theft and tampering rather than denial of service. Oracle's own 'easily exploitable' language reinforces low attack complexity. Countervailing signals lower the immediate urgency: EPSS is not provided, there is no public POC, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation yet. The main real-world exposure limiter is deployment posture - Guided Search Platform Services is typically a back-office component and its risk hinges on whether the vulnerable HTTPS endpoint is internet-facing or network-segmented; internet-exposed instances should be treated as critical, internal-only instances as high-but-contained. |
| Exploit ScenarioDerived | An attacker who can reach the Guided Search Platform Services HTTPS interface - for example an internet-exposed or loosely-segmented Forge endpoint - sends crafted requests that bypass authentication and directly invoke privileged Platform Services operations. With no credentials required and low complexity, they exfiltrate the full catalog and configuration data and can create, alter, or delete critical records. No public POC is currently known, so this would require the attacker to independently develop the exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remote attackers over HTTPS to read, create, modify, or delete all data accessible to the service without any credentials. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact and characterizes it as 'easily exploitable,' and the intelligence tags flag an authentication-bypass class issue. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs ship the corrective patches but the source data does not specify an exact fixed build number, so obtain the precise patch level for 11.4.0 from that advisory and apply it as the primary remediation. Until patched, restrict network reachability of the Guided Search Platform Services / Forge HTTPS endpoints to trusted management networks only via firewall or reverse-proxy ACLs, and ensure these services are never directly internet-exposed - the trade-off is that any legitimate remote administration or cross-datacenter indexing traffic must be explicitly allowlisted. Additionally place the service behind an authenticating reverse proxy or WAF to add an authentication layer in front of the vulnerable endpoint, accepting that this may require reconfiguring downstream integration clients.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Commerce Guided Search (formerly Endeca) is an enterprise faceted-search and product-discovery platform used in e-commerce storefronts; the affected 'Forge' component is part of the Endeca CAS/MDEX data-processing pipeline that ingests, transforms, and indexes catalog content for the Platform Services layer. The 'Authentication Bypass' tag combined with the CVSS PR:N metric indicates the flaw lets an attacker reach privileged Platform Services functionality without valid authentication, most likely through an exposed HTTPS management or data endpoint. No CWE was assigned by NVD, so the precise root-cause class (e.g., missing authentication on a critical function, CWE-306, or improper authentication, CWE-287) is inferred from the vendor tag rather than confirmed.
Know when Commerce Guided Search Platform Services gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated HTTPS-reachable authentication bypass (AV:N/AC:L/PR:N/UI:N) yielding full read and write to service data (C:H/I:H) with no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search Platform Services accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search Platform Services accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Commerce Guided Search Platform Services 11.4.0 contains a critical unauthenticated vulnerability that permits remote attackers to read, create, modify, or delete all data accessible to the service-including customer information and transaction records-without credentials. This directly exposes sensitive business and customer data to unauthorized compromise with no authentication barrier. Immediate network isolation and compensating controls are required as no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict access to trusted networks only via firewall rules and disable internet routing; (2) Deploy WAF rules to detect and block suspicious search queries and data access patterns; (3) Enable detailed audit logging on all data operations with real-time alerting for bulk modifications; (4) Implement rate limiting on search endpoints; (5) Use IP whitelisting to allow only authorized clients; (6) If not business-critical, disable the Forge component entirely pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Complete takeover of Oracle Commerce Guided Search Platform Services 11.4.0 (formerly Endeca) is possible by an unauthen
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge c
Denial-of-service and information disclosure in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component)
Exploit-DB