What is the CVSS score of CVE-2026-70978?

CVE-2026-70978 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-70978?

Oracle Commerce Guided Search/Experience Manager 11.4.0 can be compromised by unauthenticated attackers to access and modify all data the system stores, requiring no credentials or user interaction.

How to fix or mitigate CVE-2026-70978?

Within 24 hours: Conduct an asset inventory of all Oracle Commerce Guided Search/Experience Manager 11.4.0 instances across production and non-production environments and immediately restrict network access to trusted internal networks only. Implement network segmentation if internet-facing instances exist. Within 7 days: Engage Oracle support to confirm patch availability timeline and escalate for priority support; activate incident response monitoring on affected systems for unauthorized data access attempts; evaluate business continuity implications if the system must be taken offline. Within 30 days: Deploy a patched version of Oracle Commerce when released or transition to a supported replacement solution; execute full vulnerability rescanning to confirm remediation; document compensating controls in place during transition and update security inventory.

Oracle Commerce CVE-2026-70978

EUVD-2026-61925 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-j2fj-vjfm-j62g

Authentication Bypass Oracle Commerce Guided Search Commerce Experience Manager

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated HTTP-reachable authentication bypass gives AV:N/AC:L/PR:N/UI:N; full data read and write yield C:H/I:H, with no availability impact so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 00:05 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (the legacy Endeca-derived Content Acquisition System) lets a remote attacker read, create, modify, or delete all data accessible to the product over HTTP. The Oracle-supplied CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact), and the intelligence tag 'Authentication Bypass' aligns with the PR:N/UI:N vector. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network HTTP reachability to the Oracle Commerce Content Acquisition System (CAS) service of a Guided Search / Experience Manager 11.4.0 deployment; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication, no user interaction, and no non-default configuration are stated as prerequisites. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This should be treated as a genuine high priority, not a paper-tiger high score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html); Oracle publishes the exact patch set per product in that advisory, and no standalone fixed version string was included in the provided data, so consult the CPU matrix for the 11.4.0 patch bundle. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Conduct an asset inventory of all Oracle Commerce Guided Search/Experience Manager 11.4.0 instances across production and non-production environments and immediately restrict network access to trusted internal networks only. …

Threat intelligence, references, and detailed analysis are available after sign-in.