EUVD-2026-79592
GHSA-w6cv-w726-mc9j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv local logon on Forge host
-
ExploitInvoke vulnerable Forge component
-
ExecutionModify or destroy all accessible search data
-
ImpactTrigger repeatable crash (complete DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a local logon: the attacker must already have low-privileged access (PR:L) to the infrastructure/host where Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Forge component), version 11.4.0, executes. Exploitation is otherwise easy (AC:L) with no user interaction (UI:N) and no scope change (S:U). Limiting factors that reduce real-world risk: it is NOT remotely exploitable (AV:L, not AV:N), it needs an existing authenticated foothold on the server, and it affects only the specific 11.4.0 release of a niche e-commerce search product; confidentiality is unaffected (C:N), so impact is limited to data integrity and availability of the search subsystem. |
| Impact | This is a genuinely moderate-severity issue whose 7.1 CVSS score is honestly earned and correctly capped by the local attack vector. The Oracle-supplied vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) shows the critical limiter is AV:L combined with PR:L: an attacker must already have a low-privileged logon to the host/infrastructure where Oracle Commerce Guided Search / Experience Manager (Forge component) runs - this is NOT a remote, pre-auth, internet-facing bug like the WebLogic and OID CVEs in the same Sep 2026 CPU. Once local access is obtained, exploitation is easy (AC:L) with no user interaction and yields high integrity impact (create/delete/modify all accessible data) plus complete availability loss (hang/repeatable crash), while confidentiality is untouched (C:N). No EPSS, KEV, or public POC signal is present in the input: exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data provided. The net picture is a real but bounded internal/privilege-escalation-of-impact risk - prioritize for hardening of hosts running this product, but it is not an emergency internet-facing exposure. No signals conflict; the DoS-only tag understates the equal integrity impact, which the vector and description both confirm. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privileged local account on the server hosting Oracle Commerce Guided Search / Experience Manager (for example a limited application or OS user, or a compromised adjacent service on the same box) invokes the vulnerable Forge component. With no further privileges or user interaction they tamper with or destroy indexed catalog/search data and can force a repeatable crash, taking the guided-search subsystem offline. No public exploit code is identified at time of analysis, and the local-access requirement means this is a post-foothold escalation of impact rather than a mass-exploitable remote bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Local low-privileged users who can log on to a host running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can abuse the Forge component to create, delete or modify critical search data and to hang or repeatedly crash the service, producing high integrity and availability impact with no confidentiality exposure. The issue carries a CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), so it is not remotely exploitable and requires a pre-existing authenticated foothold on the server, which keeps real-world risk genuinely moderate rather than urgent. There is no CISA KEV entry and no public exploit identified at time of analysis, and exploitation is not confirmed actively exploited.
RemediationAI
Patch available per vendor advisory: Oracle addresses this in its Commerce Security Patch Update published at https://www.oracle.com/security-alerts/cspusep2026.html, and affected 11.4.0 installations should be upgraded to the fixed build listed there as soon as the change window permits; the advisory is the only authoritative source for the exact patched version, so do not substitute an untested build. Because exploitation requires local logon on the Forge host (PR:L, AV:L), the most effective interim compensating control is to tighten OS-level access: restrict interactive shell, SSH and console accounts on the server running Guided Search/Experience Manager to a small set of trusted administrators, and run Forge under a dedicated low-privilege service account with write access confined to its own data and index directories, accepting the trade-off that this breaks any shared-account operational habits and requires service-account reconfiguration plus a restart. In parallel, enable filesystem integrity and audit monitoring on the Forge index/work directories to catch unauthorised creation, deletion or modification of search data (the I:H component), and add process supervision with controlled restart thresholds and capacity headroom so that a repeatable hang or crash of Forge does not cascade into a full search outage (the A:H component); note that restart throttling can mask the underlying fault, so it should be paired with alerting rather than used as the sole remedy. If patch deployment must be deferred, these host-hardening and monitoring measures reduce exposure but do not eliminate the flaw, since any remaining local low-privileged account still satisfies the attack prerequisite.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Commerce Guided Search (the former Endeca platform) and Oracle Commerce Experience Manager 11.4.0 are built around the Endeca stack, in which Forge is the Java-based indexing/back-end component that ingests records from the CAS (Content Acquisition System) and constructs the search indices ultimately served by the MDEX Engine; because Forge runs as a server-side service, any flaw in its handling of locally supplied input or its own operational controls is reachable only by someone who already has an account on that host. No CWE is assigned and Oracle does not disclose the root-cause code path, but the CVSS profile (AV:L, AC:L, PR:L, UI:N, S:U, C:N, I:H, A:H) is consistent with a weak access-control or input-validation defect in the Forge workflow that lets a low-privileged local actor issue operations the component should have rejected, corrupting index/data state and destabilising the process into a hang or repeatable crash. The EUVD record mirrors the affected release, listing only Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0, and no CPE strings were supplied, so the exact build-level fingerprint is not independently corroborated beyond the vendor and EUVD data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Description explicitly requires a low-privileged local logon to the host (AV:L, PR:L), easy repeatable exploitation (AC:L), and yields full integrity plus complete-DoS impact with no data disclosure (C:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
Executive ViewAI
Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 carry a high-severity flaw in the Forge component that allows an already-authenticated local user on the server to corrupt or destroy critical search data and to repeatedly crash or hang the search service. Organizations relying on these platforms for storefront search and merchandising face potential data-integrity loss and customer-facing search outages, although no confidentiality exposure is possible and no public exploit has been identified at time of analysis. Leadership should care because recovery may require restoring search indexes and merchandising configuration from backup, and because every additional local account on these hosts expands the attack surface while no vendor patch is yet available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and monitor local logon on hosts running the Forge component (authenticated local access is required, per the CVSS vector), enforce least privilege for Oracle Commerce service and administrative accounts, alert on unexpected search index or merchandising data modifications and on repeated service restarts, segment the affected servers from broader administrative networks, and maintain verified offline backups of search data and configuration for rapid restoration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB