What is the CVSS score of CVE-2026-70994?

CVE-2026-70994 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-70994?

Oracle Commerce Guided Search / Experience Manager 11.4.0 contains a critical unauthenticated remote vulnerability (CVSS 9.1) enabling complete data disclosure and denial of service without…

How to fix or mitigate CVE-2026-70994?

Within 24 hours, identify and inventory all instances of Oracle Commerce Guided Search / Experience Manager 11.4.0 in production, assess which systems contain sensitive data, and disconnect public-facing instances from external networks. Within 7 days, implement network segmentation to restrict HTTP access to affected systems to internal networks only, deploy WAF rules to block suspicious patterns, enable real-time monitoring and alerting on all connection attempts to these systems, and document all network access paths. Within 30 days, establish timeline with Oracle Support for upgrade to a patched version of Endeca Application Controller, execute controlled migration to supported versions, and conduct post-incident review of detection gaps and access controls.

Oracle Commerce CVE-2026-70994

EUVD-2026-61941 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-388c-mf4q-vqj7

Authentication Bypass Oracle Commerce Experience Manager Commerce Guided Search

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network HTTP access (AV:N/AC:L/PR:N/UI:N) with full data disclosure and complete DoS but no data modification, so C:H/A:H and I:N, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:59 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

AnalysisAI

Unauthenticated remote compromise of Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) lets a network attacker read all data accessible to the product and force a complete, repeatable denial of service over HTTP. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable with no authentication or user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires network reachability to the Endeca Application Controller HTTP interface of Oracle Commerce Guided Search / Experience Manager 11.4.0; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or non-default configuration is needed to trigger it. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals align toward genuine priority: CVSS 3.1 9.1 with AV:N/AC:L/PR:N/UI:N means remote, unauthenticated, low-complexity exploitation with no user interaction, and Oracle explicitly labels it 'easily exploitable.' Confidentiality (C:H) and availability (A:H) are both fully impacted while integrity is untouched (I:N), consistent with an information-disclosure-plus-DoS bug rather than code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the fix delivered in the Oracle August 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cspuaug2026.html); an exact patched build number was not included in the source data, so pull the specific 11.4.0 patch/bundle referenced in that CPU for your platform. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory all instances of Oracle Commerce Guided Search / Experience Manager 11.4.0 in production, assess which systems contain sensitive data, and disconnect public-facing instances from external networks. …

Threat intelligence, references, and detailed analysis are available after sign-in.