What is the CVSS score of CVE-2026-70980?

CVE-2026-70980 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-70980?

Attackers can gain unrestricted access to Oracle Commerce Guided Search/Experience Manager 11.4.0 environments without credentials, compromising customer information, transaction integrity, and…

How to fix or mitigate CVE-2026-70980?

Within 24 hours, inventory all Oracle Commerce Guided Search/Experience Manager 11.4.0 instances and verify external accessibility of HTTP-facing Content Acquisition System endpoints. Over the next 7 days, implement network-layer access restrictions to limit HTTP traffic to the CAS from untrusted sources, enable comprehensive event logging on affected systems, and establish baseline monitoring for anomalous activity. Within 30 days, maintain active monitoring for Oracle's patch release, validate patch compatibility with your deployment, and prepare a staged deployment plan; concurrently, engage Oracle support to confirm the patch timeline and assess operational feasibility of temporarily disabling external CAS access as a containment measure pending patch availability.

Oracle Commerce CVE-2026-70980

EUVD-2026-61927 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-vgv4-8vmw-668f

Authentication Bypass Oracle Commerce Guided Search Commerce Experience Manager

9.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Network HTTP reach with no auth or interaction (AV:N/PR:N/UI:N), but AC:H reflects Oracle's difficult-to-exploit precondition; scope change and takeover justify S:C and C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 00:04 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

CRITICAL 9.0

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full system takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible by a remote, unauthenticated attacker reaching the Content Acquisition System (CAS) over HTTP, per Oracle's August 2026 Critical Patch Update. Successful exploitation yields complete loss of confidentiality, integrity, and availability and, because of a CVSS scope change, can significantly impact additional connected products beyond the vulnerable component itself. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker needs network HTTP access to the Content Acquisition System (CAS) component of Oracle Commerce Guided Search / Experience Manager 11.4.0; per the CVSS vector (PR:N/UI:N) no authentication and no user interaction are required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals here are deliberately mixed and should be read together. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the fixes from Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html) - patch available per vendor advisory; Oracle CPUs deliver the fix as cumulative patches for version 11.4.0 rather than as an independently tagged release, so no separate fixed version string is confirmed in the provided data and administrators should pull the exact patch bundle referenced in the CPU for their platform. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Oracle Commerce Guided Search/Experience Manager 11.4.0 instances and verify external accessibility of HTTP-facing Content Acquisition System endpoints. …

Threat intelligence, references, and detailed analysis are available after sign-in.