{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Oracle heeft 27 kwetsbaarheden verholpen in Commerce Platform, waaronder Oracle Commerce Guided Search en Oracle Commerce Experience Manager, waaronder de componenten Experience Manager, Forge en Endeca Application Controller.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle Commerce-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores variërend van middel tot hoog. Van de in totaal 27 kwetsbaarheden kunnen volgens Oracle 16 kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nDe kwetsbaarheden met de hoogste CVSS-score van 8,2 bevinden zich in de componenten Experience Manager en Forge. Succesvolle exploitatie kan, afhankelijk van de kwetsbaarheid, een hoge impact hebben op de vertrouwelijkheid of beschikbaarheid en een beperkte impact op de integriteit van het getroffen systeem.\n\nHet NCSC adviseert om de beveiligingsupdates met de hoogste CVSS-scores met voorrang toe te passen.", "title": "Interpretaties" }, { "category": "description", "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://www.oracle.com/security-alerts/cspusep2026.html" } ], "title": "Kwetsbaarheden verholpen in Oracle Commerce Platform", "tracking": { "current_release_date": "2026-09-16T13:51:37.603432Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0374", "initial_release_date": "2026-09-16T13:51:37.603432Z", "revision_history": [ { "date": "2026-09-16T13:51:37.603432Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "Commerce" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "Oracle Commerce Guided Search / Oracle Commerce Experience Manager" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-3" } } ], "category": "product_name", "name": "Oracle Commerce Guided Search / Oracle Commerce Experience Manager" } ], "category": "vendor", "name": "Oracle Corporation" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-83233", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical or all accessible data, with a CVSS 3.1 base score of 7.7.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83233 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83233.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 7.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83233" }, { "cve": "CVE-2026-83234", "notes": [ { "category": "description", "text": "A critical vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated remote attackers to gain unauthorized access and modify sensitive data, with a CVSS 3.1 base score of 8.2.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83234 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83234.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "baseScore": 8.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83234" }, { "cve": "CVE-2026-83235", "notes": [ { "category": "description", "text": "A critical vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83235 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83235.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83235" }, { "cve": "CVE-2026-83236", "notes": [ { "category": "description", "text": "A critical vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83236 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83236.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "baseScore": 8.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83236" }, { "cve": "CVE-2026-83237", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows a low-privileged attacker with HTTP network access to gain unauthorized critical data access and cause partial denial of service, rated CVSS 7.1.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83237 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83237.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83237" }, { "cve": "CVE-2026-83238", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows a low-privileged attacker with HTTP network access to gain unauthorized critical data access and cause partial denial of service, rated CVSS 7.1.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83238 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83238.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83238" }, { "cve": "CVE-2026-83239", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows a low-privileged attacker with infrastructure access to potentially compromise the application, with a CVSS 3.1 base score of 7.0 indicating high impact.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83239 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83239.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83239" }, { "cve": "CVE-2026-83240", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows low-privileged attackers to modify or delete critical data and cause denial-of-service, with a CVSS 3.1 score of 7.1 indicating high impact on integrity and availability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83240 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83240.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83240" }, { "cve": "CVE-2026-83241", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search and Experience Manager 11.4.0 allows unauthenticated network attackers to potentially take over the system, impacting confidentiality, integrity, and availability with a CVSS 3.1 score of 7.5.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83241 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83241.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83241" }, { "cve": "CVE-2026-83242", "notes": [ { "category": "description", "text": "A critical vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated remote attackers to modify data, access sensitive information, and cause partial denial of service, rated CVSS 3.1 base score 7.3.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83242 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83242.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83242" }, { "cve": "CVE-2026-83243", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical or all accessible data, with a CVSS 3.1 base score of 7.7.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83243 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83243.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 7.7, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83243" }, { "cve": "CVE-2026-83244", "notes": [ { "category": "description", "text": "Oracle Commerce Guided Search / Experience Manager 11.4.0 contains a vulnerability exploitable by unauthenticated attackers with network access, enabling unauthorized data access, modification, or denial-of-service, rated CVSS 7.1.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83244 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83244.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83244" }, { "cve": "CVE-2026-83245", "notes": [ { "category": "description", "text": "A high-severity vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability via HTTP access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83245 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83245.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83245" }, { "cve": "CVE-2026-83246", "notes": [ { "category": "description", "text": "A high-severity vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability via HTTP access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83246 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83246.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83246" }, { "cve": "CVE-2026-83247", "notes": [ { "category": "description", "text": "A high-severity vulnerability (CVSS 7.8) in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated attackers with infrastructure access and user interaction to potentially compromise system confidentiality, integrity, and availability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83247 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83247.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83247" }, { "cve": "CVE-2026-83248", "notes": [ { "category": "description", "text": "A critical vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated network attackers to cause denial of service and unauthorized data read access, rated CVSS 3.1 base score 8.2.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83248 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83248.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83248" }, { "cve": "CVE-2026-83249", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search and Experience Manager 11.4.0 allows a low-privileged attacker with infrastructure access to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83249 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83249.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83249" }, { "cve": "CVE-2026-83250", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated network attackers via HTTP to access critical data and cause partial denial of service, rated CVSS 3.1 score 6.5.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83250 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83250.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83250" }, { "cve": "CVE-2026-83251", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated attackers with network TLS access to cause denial of service and unauthorized data read, rated CVSS 3.1 score 6.5.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83251 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83251.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83251" }, { "cve": "CVE-2026-83252", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated attackers with HTTP network access to gain unauthorized data access, modify data, and cause partial denial of service, rated CVSS 7.0.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83252 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83252.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "baseScore": 7.0, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83252" }, { "cve": "CVE-2026-83253", "notes": [ { "category": "description", "text": "A high-severity vulnerability (CVSS 7.8) in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated attackers with infrastructure access and user interaction to potentially compromise system confidentiality, integrity, and availability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83253 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83253.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83253" }, { "cve": "CVE-2026-83254", "notes": [ { "category": "description", "text": "A high-severity vulnerability in Oracle Commerce Guided Search and Experience Manager 11.4.0 allows unauthenticated network attackers to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.1.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83254 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83254.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83254" }, { "cve": "CVE-2026-83255", "notes": [ { "category": "description", "text": "A high-severity vulnerability in Oracle Commerce Guided Search and Experience Manager 11.4.0 allows unauthenticated network attackers to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.1.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83255 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83255.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83255" }, { "cve": "CVE-2026-83256", "notes": [ { "category": "description", "text": "A high-severity vulnerability in Oracle Commerce Guided Search and Experience Manager 11.4.0 allows unauthenticated network attackers to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.1.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83256 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83256.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83256" }, { "cve": "CVE-2026-83257", "notes": [ { "category": "description", "text": "A high-severity vulnerability in Oracle Commerce Guided Search and Experience Manager 11.4.0 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83257 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83257.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83257" }, { "cve": "CVE-2026-83258", "notes": [ { "category": "description", "text": "A high-severity vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability via HTTP access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83258 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83258.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83258" }, { "cve": "CVE-2026-83259", "notes": [ { "category": "description", "text": "A vulnerability in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows a low-privileged attacker with HTTP network access to gain unauthorized critical data access and cause partial denial of service, rated CVSS 7.1.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-83259 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83259.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-83259" } ] }