What is the CVSS score of CVE-2026-70990?

CVE-2026-70990 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Commerce Guided Search CVE-2026-70990

EUVD-2026-61937 MEDIUM

Information Exposure (CWE-200)

2026-08-18 secalert_us@oracle.com

GHSA-r96w-h85v-98w8

Authentication Bypass Information Disclosure Oracle Commerce Guided Search Commerce Experience Manager

6.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

Network-accessible authentication bypass with scope change; AC:H reflects exploitation requires specific conditions; confidentiality-only impact as no integrity or availability effect is described.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 04:58 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized access to critical commerce data is achievable against Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via a network-accessible authentication bypass in the Content Acquisition System component. The vulnerability carries a CVSS scope change, meaning successful exploitation can spill over to compromise data accessible by additional integrated Oracle Commerce components beyond the directly attacked service. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires unauthenticated network access via HTTP to the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically version 11.4.0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 6.8 is driven primarily by the combination of network reachability, no authentication requirement, scope change, and high confidentiality impact - but the AC:H metric is a meaningful modifier, indicating that exploitation is not straightforward and depends on specific conditions beyond the attacker's direct control, such as a particular system state, timing, or environmental prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Organizations should apply Oracle's Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which contains the fix for this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.