EUVD-2026-79603
GHSA-9rm8-c4xv-2cx5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Network-reachable and unauthenticated per Oracle, but AC:H reflects the stated difficulty and no integrity impact; availability is the dominant loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager and unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H).
AnalysisAI
Unauthenticated network attackers with access to the TLS interface of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can trigger a hang or repeatedly crash the Forge component while also reading a limited subset of application-accessible data. Oracle's advisory rates it 6.5 (AV:N/AC:H/PR:N/UI:N/C:L/A:H), so impact is dominated by availability loss rather than data compromise, and the high attack complexity suggests exploitation requires carefully crafted conditions rather than a trivial request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector (AV:N/PR:N/UI:N), no authentication and no user interaction are required - the attacker only needs network reachability to the TLS interface of the Oracle Commerce Forge component in Guided Search / Experience Manager 11.4.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but lean toward a moderate, availability-centric risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the current Oracle Critical Patch Update for Oracle Commerce Guided Search / Experience Manager as documented in https://www.oracle.com/security-alerts/cspusep2026.html - because the input does not state an exact patched build number, confirm the fixed 11.4.0 patch level against Oracle's CPU matrix before closing the ticket rather than assuming any 11.4.0 install is remediated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today