What is the CVSS score of CVE-2026-70988?

CVE-2026-70988 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-70988?

Oracle Commerce Guided Search and Experience Manager 11.4.0 contains a vulnerability that exposes all application-accessible data to any authenticated network user with low-privilege credentials,…

How to fix or mitigate CVE-2026-70988?

Within 24 hours, identify all systems running Oracle Commerce Experience Manager 11.4.0 and classify data sensitivity and network exposure. Within 7 days, implement compensating controls: restrict network access to the Content Acquisition System component through firewall or network segmentation, enforce strict role-based access controls limiting user privileges, implement comprehensive logging and alerting for data access patterns and queries, and evaluate the operational necessity of disabling Guided Search functionality temporarily if feasible. Within 30 days, coordinate with Oracle support to establish an upgrade timeline to a patched version or supported alternative product, establish continuous monitoring of Oracle and CISA security advisories for patch availability, and conduct a security assessment of exposed data.

Oracle Commerce CVE-2026-70988

EUVD-2026-61935 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-c5gc-6rxp-2g57

Authentication Bypass Oracle Commerce Experience Manager Commerce Guided Search

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Consistent with vendor-supplied vector: network-reachable CAS endpoint, low complexity, low-privilege auth required, scope change to adjacent components, confidentiality-only impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 00:01 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes complete confidentiality of application-accessible data to low-privileged, network-authenticated attackers via HTTP. The vulnerability resides in the Content Acquisition System component and carries a scope-change classification, meaning successful exploitation can extend impact beyond the directly targeted system to affect additional Oracle Commerce components. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid low-privileged account on the Oracle Commerce Guided Search / Oracle Commerce Experience Manager platform - the CVSS PR:L metric confirms authenticated access is a prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.7 is well-supported by the vector metrics: network reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction (UI:N), and a scope change (S:C) driving the high confidentiality impact (C:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary remediation is to apply Oracle's Critical Patch Update for August 2026, available via the Oracle CPU advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.