EUVD-2026-47362
GHSA-vhpc-3rg9-fhfp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Platform Services HTTP endpoint
-
DeliverySend crafted request to Forge
-
ExploitTrigger unauthenticated flaw
-
ExecutionGain service takeover
-
ImpactAccess/alter catalog and index data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Commerce Guided Search Platform Services 11.4.0, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The concrete prerequisite is network reachability of the Forge component's HTTP interface; the primary limiting factor is therefore network exposure, because Platform Services/Forge is typically a back-end tier that is not (and should not be) internet-facing, so real-world exploitability hinges on whether an attacker can route to that endpoint. Only version 11.4.0 is confirmed affected, which further bounds the exposed population. |
| Impact | All available signals point to genuinely high risk rather than a paper-only high score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) means network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and Oracle explicitly calls it 'easily exploitable' with a 'takeover' outcome. Scope is Unchanged (S:U) but all three impacts are High. No EPSS score was provided in the input, so exploitation probability cannot be quantified here, and there is no SSVC decision record, no POC, and no KEV listing - meaning active exploitation is not confirmed. The one caveat worth verifying is that no CWE is published, so the exact exploitation mechanism is inferred; the raw exposure profile, however, is unambiguous and warrants prompt remediation regardless of the missing EPSS/CWE detail. |
| Exploit ScenarioDerived | An attacker who can reach the Oracle Commerce Guided Search Platform Services HTTP interface sends a single crafted request to the Forge component and, without any credentials or user interaction, gains full control of the service. From there they can read or tamper with catalog/index data and pivot within the e-commerce back end. No public POC is identified at time of analysis, but the low attack complexity means weaponization would be straightforward once details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Complete takeover of Oracle Commerce Guided Search Platform Services 11.4.0 (formerly Endeca) is possible by an unauthenticated remote attacker sending crafted HTTP requests to the Forge component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and lack of authentication make it a high-priority patch target.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); no exact patched build number is given in the input, so treat this as 'patch available per vendor advisory' and pull the specific patch for Guided Search Platform Services 11.4.0 from the CPU matrix. Until patching is complete, reduce exposure by restricting network access to the Forge/Platform Services HTTP endpoints so they are reachable only from trusted internal management hosts (place them behind a firewall/VPN or internal-only VLAN), since these components are back-end data-processing services that should never be internet-facing - the trade-off is minimal for most deployments because Platform Services is not a customer-facing tier. Avoid exposing the Endeca administrative/Forge ports (commonly in the 8000-range) to untrusted networks, and monitor those endpoints for anomalous HTTP requests as a detection compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Commerce Guided Search (the product line descended from Oracle Endeca) provides faceted/guided navigation and search for large e-commerce catalogs. The affected 'Forge' component is the Endeca data-processing/pipeline engine that ingests, transforms, and indexes catalog data to build the MDEX search index. Because Oracle assigns no CWE for this entry, the precise root-cause class is unpublished, but a 9.8 vector with full C/I/A impact and 'takeover' language over HTTP is consistent with an unauthenticated deserialization, injection, or authentication-bypass flaw in an exposed Platform Services HTTP endpoint. Oracle's own tag of 'Information Disclosure' suggests confidentiality exposure is a notable facet of the impact.
Know when Commerce Guided Search Platform Services gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes easily exploitable, unauthenticated, network HTTP takeover with full impact, so AV:N/AC:L/PR:N/UI:N and C/I/A all High; scope unchanged as no cross-component compromise is stated.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search Platform Services. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Commerce Guided Search Platform Services 11.4.0 is vulnerable to unauthenticated remote code execution with a CVSS score of 9.8, allowing attackers to achieve complete system takeover without credentials. Organizations deploying this platform face immediate risk of data exfiltration, operational disruption, and supply chain compromise. No vendor patch has been released, making urgent interim containment essential.
Restrict Forge component access via network segmentation and firewall rules using IP whitelisting; deploy WAF rules to block suspicious HTTP patterns; maintain comprehensive audit logging of all requests to the Guided Search Platform; consider temporary disabling of non-critical Guided Search features until patch availability; monitor vendor advisories and security bulletins weekly for patch release and interim security updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge c
Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remot
Denial-of-service and information disclosure in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component)
Exploit-DB