EUVD-2026-61932
GHSA-2653-5v7c-4cqc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network HTTP access with no authentication aligns with AV:N/PR:N; confidentiality-only impact per vendor description supports C:H/I:N/A:N with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthenticated data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows remote attackers to access all data managed by the Content Acquisition System component over HTTP with no credentials required. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 (High) with a fully unauthenticated, low-complexity network attack vector, enabling complete confidentiality compromise of indexed and managed content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only HTTP network access to the Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 instance, specifically the Content Acquisition System component endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (High) accurately reflects a significant real-world risk for organizations that expose the Content Acquisition System to untrusted networks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update for August 2026 as the primary remediation, detailed at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle Commerce Guided Search and Experience Manager 11.4.0 instances in production, staging, and development environments; document what data each instance manages and assess exposure to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Commerce Experience Manager
View allFull takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible when a low-privil
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Co
Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Co
Unauthenticated authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Appl
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Conte
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manag
Data tampering and complete denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acqu
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote, unauthenticated attack
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Applicati
Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (the legacy Endeca-derived
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today