What is the CVSS score of CVE-2026-71010?

CVE-2026-71010 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Commerce are affected by CVE-2026-71010?

Oracle Commerce Guided Search and Experience Manager 11.4.0 contains a critical vulnerability enabling complete system takeover via local access and user interaction.

How to fix or mitigate CVE-2026-71010?

Within 24 hours, conduct a system inventory to identify all Oracle Commerce Guided Search and Experience Manager 11.4.0 installations and validate local network access controls. Within 7 days, deploy enhanced monitoring and logging for these systems, create a documented patching procedure, and evaluate operational feasibility of temporarily disabling services if non-critical. Within 30 days, monitor Oracle security advisories for vendor patch releases and prepare to deploy patches immediately upon availability.

Oracle Commerce CVE-2026-71010

EUVD-2026-61957 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-5gxv-xjxr-xpw2

Oracle Authentication Bypass Commerce Experience Manager Commerce Guided Search

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and no-privilege requirement confirmed by description; user interaction trigger and full C/I/A impact align with Oracle's own vector.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:24 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full system takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a local, unauthenticated attacker who can engineer human interaction from a legitimate user on the same infrastructure. Disclosed in Oracle's August 2026 Critical Security Patch Update, the vulnerability results in complete compromise of confidentiality, integrity, and availability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must possess local logon access (operating-system level) to the host infrastructure running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 - this is the defining and non-negotiable prerequisite established by AV:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.8 accurately reflects high severity but the local attack vector (AV:L) and mandatory user interaction (UI:R) substantially narrow the realistic attack surface compared to network-exploitable vulnerabilities of equivalent score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the patch issued as part of Oracle's Critical Security Patch Update for August 2026, available via the official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct a system inventory to identify all Oracle Commerce Guided Search and Experience Manager 11.4.0 installations and validate local network access controls. …

Threat intelligence, references, and detailed analysis are available after sign-in.