SB2026110747 - Multiple vulnerabilities in Oracle Commerce Guided Search

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110747

SB2026110747 - Multiple vulnerabilities in Oracle Commerce Guided Search

Published: November 7, 2026

Security Bulletin ID SB2026110747
CSH Severity
High
Patch available
YES
Number of vulnerabilities 26
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 38% Low 12%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 26 vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2026-61163)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


2) Improper input validation (CVE-ID: CVE-2026-61146)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


3) Improper input validation (CVE-ID: CVE-2026-4176)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Third-party components (Perl) component in TimesTen In-Memory Database. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


4) Improper input validation (CVE-ID: CVE-2026-61145)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


5) Improper input validation (CVE-ID: CVE-2026-61161)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


6) Improper input validation (CVE-ID: CVE-2026-61154)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Forge component in Oracle Commerce Guided Search Platform Services. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


7) Improper input validation (CVE-ID: CVE-2026-61153)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


8) Improper input validation (CVE-ID: CVE-2026-61155)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read data or crash the application.

The vulnerability exists due to improper input validation within the Forge component in Oracle Commerce Guided Search Platform Services. A remote non-authenticated attacker can exploit this vulnerability to read data or crash the application.


9) Improper input validation (CVE-ID: CVE-2026-61156)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Forge component in Oracle Commerce Guided Search Platform Services. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


10) Improper input validation (CVE-ID: CVE-2026-61148)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


11) Improper input validation (CVE-ID: CVE-2026-61149)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


12) Improper input validation (CVE-ID: CVE-2026-61150)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.


13) Improper input validation (CVE-ID: CVE-2026-61160)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read data or crash the application.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read data or crash the application.


14) Improper input validation (CVE-ID: CVE-2026-61152)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.


15) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-34487)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log output in the cloud membership for clustering component when writing log messages. A remote attacker can trigger log entries that expose the Kubernetes bearer token to disclose sensitive information.


16) Resource exhaustion (CVE-ID: CVE-2026-42587)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in HttpContentDecompressor and DelegatingDecompressorFrameListener when processing compressed HTTP request bodies with Content-Encoding set to br, zstd, or snappy. A remote attacker can send a specially crafted compressed payload to cause a denial of service.

The configured maxAllocation limit is enforced for gzip and deflate, but is silently ignored for brotli, zstd, and snappy. The issue affects both HTTP/1.1 and HTTP/2 handling.


17) Resource exhaustion (CVE-ID: CVE-2025-48976)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to Apache Commons FileUpload provided a hard-coded limit of 10kB for the size of the headers associated with a multipart request. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


18) Improper input validation (CVE-ID: CVE-2026-61157)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


19) Improper input validation (CVE-ID: CVE-2026-61159)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


20) Improper input validation (CVE-ID: CVE-2026-61158)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


21) Improper input validation (CVE-ID: CVE-2026-61164)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


22) Improper input validation (CVE-ID: CVE-2026-61151)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Experience Manager component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.


23) Improper input validation (CVE-ID: CVE-2026-61162)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Endeca Application Controller component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A local authenticated user can exploit this vulnerability to read and manipulate data.


24) Improper input validation (CVE-ID: CVE-2026-61165)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to access sensitive information or perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Forge component in Oracle Commerce Guided Search Platform Services. A remote authenticated user can exploit this vulnerability to access sensitive information or perform a denial of service (DoS) attack.


25) Unsynchronized access to shared data in a multithreaded context (CVE-ID: CVE-2025-14017)

CWE-ID: CWE-567 - Unsynchronized Access to Shared Data in a Multithreaded Context

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when performing multithreaded LDAPS transfers (LDAP over TLS) with libcurl. Changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. For example, disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well, leading to a MitM attacks against other websites.


26) Improper input validation (CVE-ID: CVE-2026-61147)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Content Acquisition System component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager. A local non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References