What is the CVSS score of CVE-2026-71009?

CVE-2026-71009 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Commerce Experience Manager are affected by CVE-2026-71009?

Oracle Commerce Guided Search/Experience Manager 11.4.0 contains an unauthenticated authentication bypass that grants attackers full read and write access to all customer data, transaction records,…

How to fix or mitigate CVE-2026-71009?

Within 24 hours, identify all Oracle Commerce 11.4.0 instances deployed across production, pre-production, and development environments using asset management tools or network scanning. Within 7 days, implement compensating controls: restrict network access to Commerce instances to trusted internal networks only, deploy a Web Application Firewall to block unauthorized access to sensitive endpoints, and enable detailed audit logging for all data access attempts and API calls. Within 30 days, engage Oracle for patching timeline and feasibility, evaluate whether upgrades to patched Commerce versions are viable for your architecture, and establish a remediation schedule that treats this as a critical priority.

Oracle Commerce Experience Manager CVE-2026-71009

EUVD-2026-61956 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-5xmj-qvwg-cpqq

Authentication Bypass Oracle Commerce Guided Search Commerce Experience Manager

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network HTTP attack surface with no authentication required confirmed; AC:H reflects Oracle-stated difficulty and absence of known working exploits; no availability impact per description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:24 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to fully compromise data confidentiality and integrity over HTTP. The 'Authentication Bypass' tag and PR:N vector confirm that no credentials are required, though AC:H indicates exploitation demands specific conditions or non-trivial technique. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires unauthenticated network access to the Oracle Commerce Experience Manager HTTP interface, confirmed by PR:N in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.4 is driven by high confidentiality and integrity impacts with a network attack vector and no authentication requirement, partially offset by the AC:H metric indicating difficult exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the Oracle Critical Security Patch Update (CPU) published in August 2026, referenced at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all Oracle Commerce 11.4.0 instances deployed across production, pre-production, and development environments using asset management tools or network scanning. …

Threat intelligence, references, and detailed analysis are available after sign-in.