What is the CVSS score of CVE-2026-71012?

CVE-2026-71012 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle Commerce are affected by CVE-2026-71012?

Oracle Commerce Guided Search and Experience Manager version 11.4.0 contains an authenticated network vulnerability (CVSS 7.1) that allows low-privileged users to read sensitive application data,…

How to fix or mitigate CVE-2026-71012?

Within 24 hours, inventory all systems running Oracle Commerce version 11.4.0 and confirm network accessibility; isolate affected instances from untrusted networks if possible. Within 7 days, implement strict network segmentation and IP whitelisting to restrict access to authenticated user accounts, audit logs for unauthorized access attempts, and establish elevated monitoring for anomalous data queries. Within 30 days, contact Oracle for patch status updates, evaluate upgrade paths to patched versions, or implement compensating controls such as web application firewalls with rules blocking suspicious data exfiltration patterns.

Oracle Commerce CVE-2026-71012

EUVD-2026-61959 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-69gr-x3q5-rqqw

Authentication Bypass Denial Of Service Oracle Commerce Experience Manager Commerce Guided Search

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Matches vendor-provided vector; PR:L confirmed by description requiring low-privilege account, C:H by full data access, A:L by partial DOS, I:N as no write impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:22 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

AnalysisAI

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes a network-accessible flaw allowing low-privileged authenticated attackers via HTTP to read critical or all accessible application data and cause partial availability disruption. The CVSS 3.1 score of 7.1 reflects high confidentiality impact combined with low availability impact, with no integrity impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to hold at least a low-privileged account on the Oracle Commerce platform (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.1 (High) is driven primarily by the high confidentiality impact (C:H) against Oracle Commerce data, with a low availability impact (A:L) and no integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the Oracle Critical Security Patch Update (CPU) for August 2026, referenced at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability for Oracle Commerce Experience Manager 11.4.0. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running Oracle Commerce version 11.4.0 and confirm network accessibility; isolate affected instances from untrusted networks if possible. …

Threat intelligence, references, and detailed analysis are available after sign-in.