What is the CVSS score of CVE-2026-71008?

CVE-2026-71008 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Commerce Experience Manager CVE-2026-71008

EUVD-2026-61955 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-7v3f-v65c-rfx9

Authentication Bypass Oracle Commerce Guided Search Commerce Experience Manager

6.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

Network-accessible HTTP with no user interaction; high privileges required per description; scope change to adjacent components confirmed; impact is confidentiality-only with no integrity or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 04:49 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Confidential data exposure in Oracle Commerce Guided Search / Experience Manager 11.4.0 enables high-privileged network attackers to read critical platform data over HTTP, with a confirmed scope change extending potential impact to adjacent Oracle Commerce components beyond the primary application. The attack requires no user interaction and is characterized as easily exploitable at low complexity, though the high privilege prerequisite narrows the attacker pool. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a high-privileged account on Oracle Commerce Experience Manager (PR:H per vendor-supplied CVSS vector) with network-level HTTP access to the application - this is not a default-credential or unauthenticated attack path under the stated CVSS metrics. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 6.8 reflects a bounded but real risk: while AV:N and AC:L indicate network-reachable, low-complexity exploitation, the PR:H requirement substantially restricts the viable attacker pool to those already holding administrative credentials to the application. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability in Oracle Commerce Experience Manager 11.4.0 as documented in EUVD-2026-61955. … Detailed patch versions, workarounds, and compensating controls in full report.