Oracle Commerce Guided Search EUVD-2026-47363

Exploitation requires only network HTTP access to the Oracle Commerce Guided Search Platform Services / Forge endpoint on version 11.4.0 - the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the vendor 'Authentication Bypass' tag indicate no authentication, no user interaction, and low complexity against an affected installation. The practical limiting factor is reachability: Guided Search Platform Services and the Forge data-processing pipeline are typically deployed on internal e-commerce back-end infrastructure, so exploitation depends on the attacker having a network path (internal foothold, adjacent segment, or a misconfigured internet exposure) to the HTTP service. It is version-specific to 11.4.0, and the exact vulnerable endpoint/feature is not detailed in Oracle's advisory.

The signals are strongly aligned toward high real-world risk on any exposed instance: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation, and the vendor tag 'Authentication Bypass' reinforces the PR:N reading. Impact is asymmetric - C:H and A:H but I:N - meaning an attacker can exfiltrate all data the service can reach and can take it fully offline (complete DOS), but cannot tamper with data through this flaw, which is why the base score is 9.1 rather than 10.0. Mitigating the urgency: there is no CISA KEV listing, no POC, and no EPSS score provided, so there is no evidence of active or automated exploitation yet, and Oracle's advisories are intentionally low on technical detail, so the exact attack primitive is unconfirmed. The dominant limiting factor in practice is network exposure - Guided Search Platform Services and the Forge pipeline are usually deployed inside back-end/internal e-commerce infrastructure rather than directly on the internet, so exposure depends heavily on network segmentation.

An attacker who can reach the Guided Search Platform Services HTTP interface - for example from a compromised host on the same network segment, or directly if the service is inadvertently internet-exposed - sends a crafted request that bypasses authentication on the Forge component. In a single unauthenticated request they read sensitive catalog or configuration data the service can access, and can follow up with a request that forces the service into a repeatable crash or hang, taking the guided-search function of the storefront fully offline. No public exploit code is known at time of analysis, so this would require original research or reverse-engineering of the CPU patch.