Commerce Guided Search Platform Services
Monthly
Denial-of-service and information disclosure in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests to hang or repeatedly crash the service (complete DoS) and read a subset of accessible data. The flaw is rated CVSS 3.1 7.1 and was disclosed by Oracle in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle characterizes it as easily exploitable.
Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remote attackers over HTTPS to read, create, modify, or delete all data accessible to the service without any credentials. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact and characterizes it as 'easily exploitable,' and the intelligence tags flag an authentication-bypass class issue. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a remote attacker send crafted HTTP requests to read all data accessible to the service and to crash or hang it completely. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and availability impact and no integrity impact; disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the combination of network reachability, no authentication, and low complexity makes it an urgent patch priority.
Complete takeover of Oracle Commerce Guided Search Platform Services 11.4.0 (formerly Endeca) is possible by an unauthenticated remote attacker sending crafted HTTP requests to the Forge component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and lack of authentication make it a high-priority patch target.
Denial-of-service and information disclosure in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests to hang or repeatedly crash the service (complete DoS) and read a subset of accessible data. The flaw is rated CVSS 3.1 7.1 and was disclosed by Oracle in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle characterizes it as easily exploitable.
Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remote attackers over HTTPS to read, create, modify, or delete all data accessible to the service without any credentials. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact and characterizes it as 'easily exploitable,' and the intelligence tags flag an authentication-bypass class issue. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a remote attacker send crafted HTTP requests to read all data accessible to the service and to crash or hang it completely. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and availability impact and no integrity impact; disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the combination of network reachability, no authentication, and low complexity makes it an urgent patch priority.
Complete takeover of Oracle Commerce Guided Search Platform Services 11.4.0 (formerly Endeca) is possible by an unauthenticated remote attacker sending crafted HTTP requests to the Forge component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and lack of authentication make it a high-priority patch target.