CVE-2026-83235: Oracle Commerce Experience Manager Info Leak

CVE-2026-83235 Overview

CVE-2026-83235 is an information disclosure vulnerability in the Oracle Commerce Guided Search and Oracle Commerce Experience Manager products, within the Experience Manager component. The affected supported release is version 11.4.0. An unauthenticated remote attacker can exploit the flaw over HTTP to gain unauthorized access to all data accessible through Oracle Commerce Guided Search / Experience Manager. Oracle disclosed the issue in Oracle Security Alert CSPUSEP2026.

Critical Impact
Unauthenticated network attackers can read confidential Oracle Commerce data without user interaction, exposing merchandising configurations, customer-facing content, and potentially sensitive catalog information.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Oracle Commerce (Experience Manager component)

Discovery Timeline

2026-09-15 - CVE-2026-83235 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83235

Vulnerability Analysis

The vulnerability resides in the Experience Manager component of Oracle Commerce Guided Search / Experience Manager 11.4.0. An attacker with network reachability to the HTTP interface can trigger the flaw without authentication or user interaction. Successful exploitation results in unauthorized read access to sensitive data managed by the product.

The issue affects only confidentiality. Integrity and availability of the system are not impacted, meaning the attacker cannot modify records or disrupt service through this specific flaw. However, exposed data may include merchandising configurations, category structures, product metadata, and administrative content served by the Experience Manager. EPSS currently reports a 0.316% probability of exploitation in the next 30 days.

Root Cause

Oracle has not publicly published the underlying weakness class in its advisory. Based on the CVSS profile of unauthenticated network access with a confidentiality-only impact, the flaw is consistent with a missing authorization or improper access control check in an HTTP endpoint of the Experience Manager component. The endpoint appears to return protected data to callers who should not have privileges to view it.

Attack Vector

Exploitation requires only HTTP access to the Experience Manager service. The attacker sends crafted requests to the vulnerable endpoint and receives sensitive response data. No credentials, tokens, or victim interaction are required, which makes exposure of the service to untrusted networks the primary risk multiplier.

Oracle has not released public proof-of-concept code, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical detail.

Detection Methods for CVE-2026-83235

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Commerce Experience Manager endpoints originating from unexpected source IP addresses or geographies.
HTTP response codes of 200 with large response bodies to requests that lack authenticated session cookies or authorization headers.
Repeated enumeration patterns against Experience Manager URLs, particularly asset, page, and content preview paths.

Detection Strategies

Deploy web application firewall rules that flag unauthenticated access to Experience Manager administrative and content APIs.
Correlate access logs to identify sessions retrieving bulk content data without a preceding successful authentication event.
Baseline normal traffic volumes to Oracle Commerce endpoints and alert on statistical deviations that suggest scraping or data exfiltration.

Monitoring Recommendations

Forward Oracle Commerce application, HTTP access, and reverse proxy logs to a centralized SIEM for retention and correlation.
Monitor egress traffic volumes from Oracle Commerce hosts for spikes that could indicate bulk data disclosure.
Alert on new external IPs reaching Experience Manager management URLs, and on user-agent strings associated with scanning frameworks.

How to Mitigate CVE-2026-83235

Immediate Actions Required

Apply the fix documented in Oracle Security Alert CSPUSEP2026 to all Oracle Commerce Guided Search / Experience Manager 11.4.0 deployments.
Restrict network access to Experience Manager HTTP endpoints so that only trusted management networks and authenticated commerce services can reach them.
Audit HTTP access logs for the past 90 days to identify unauthenticated requests that may have returned sensitive data.

Patch Information

Oracle addressed this vulnerability in the security alert bundle referenced as CSPUSEP2026. Administrators should download and install the patch that corresponds to Oracle Commerce Guided Search / Experience Manager 11.4.0 from My Oracle Support and validate installation against the checksums provided in the advisory.

Workarounds

Place Experience Manager behind an authenticating reverse proxy or VPN if patching cannot be performed immediately.
Use network access control lists to limit inbound HTTP traffic to the Experience Manager port to a defined administrative allowlist.
Disable public exposure of preview and management URLs at the load balancer or WAF layer until the vendor patch is applied.

bash

# Example nginx access restriction for Oracle Commerce Experience Manager
location /ecm/ {
    allow 10.10.0.0/16;      # trusted admin network
    deny  all;
    proxy_pass http://oracle-commerce-backend;
}