What is the CVSS score of CVE-2026-71017?

CVE-2026-71017 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Oracle Commerce Endeca CVE-2026-71017

EUVD-2026-61964 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-788f-mfh5-w46p

Authentication Bypass Denial Of Service Oracle Commerce Experience Manager Commerce Guided Search

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

6.5 MEDIUM

Network reachable via HTTP with no credentials; AC:H reflects non-trivial exploit condition; C:H and A:L match full data read and partial DoS; I:N confirmed by description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 04:48 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L).

AnalysisAI

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes critical data and partial denial-of-service risk via the Endeca Application Controller component over HTTP. An unauthenticated network attacker exploiting this vulnerability - tagged as an authentication bypass - can gain complete read access to all data accessible within the Oracle Commerce platform and degrade service availability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network access to the Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 Endeca Application Controller component over HTTP. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-published CVSS 3.1 score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L) reflects a moderately critical issue with an important nuance: AC:H designates high attack complexity, meaning exploitation is not straightforward and likely requires specific environmental conditions, timing, or non-default request characteristics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the patch released as part of the Oracle Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.