What is the CVSS score of CVE-2026-71024?

CVE-2026-71024 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle Commerce Guided Search are affected by CVE-2026-71024?

Oracle Commerce Guided Search and Experience Manager version 11.4.0 contains a critical vulnerability permitting unauthenticated remote attackers to exfiltrate all platform data and degrade service…

How to fix or mitigate CVE-2026-71024?

Within 24 hours, audit your infrastructure for all deployed instances of Oracle Commerce Experience Manager 11.4.0 and determine which systems have direct network exposure; document business criticality of affected instances. Within 7 days, apply Oracle's Critical Security Patch Update for August 2026 to all identified systems, prioritizing production environments; apply network segmentation to the Forge component immediately if patching cannot be completed by day 7. By day 30, verify successful patch deployment across all systems by confirming version updates, and conduct a security audit of access logs from the past 30 days to detect unauthorized data queries or exfiltration attempts.

Oracle Commerce Guided Search CVE-2026-71024

EUVD-2026-61971 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-j4gj-66x6-crwm

Authentication Bypass Denial Of Service Oracle Commerce Guided Search Commerce Experience Manager

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Network-delivered unauthenticated HTTP exploitation with high confidentiality impact and partial availability disruption; no integrity impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:18 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).

AnalysisAI

Remote unauthenticated access to the Forge component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 allows network-based attackers to read all data accessible to the platform and inflict partial denial of service via ordinary HTTP requests. The CVSS vector confirms no authentication, user interaction, or special configuration is required, placing this firmly in the automatable, high-priority tier. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions are required - remote unauthenticated exploitation applies against default configurations of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 with HTTP access to the Forge component. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	With a CVSS 3.1 base score of 8.2 and a vector of AV:N/AC:L/PR:N/UI:N, this vulnerability is trivially automatable and requires no attacker foothold - any organization running Oracle Commerce 11.4.0 with internet or intranet HTTP exposure is within the blast radius; even a mid-sized municipal IT team in ustka running this platform for an online services portal should treat this as urgent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Security Patch Update for August 2026, which addresses this vulnerability and is documented at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit your infrastructure for all deployed instances of Oracle Commerce Experience Manager 11.4.0 and determine which systems have direct network exposure; document business criticality of affected instances. …

Threat intelligence, references, and detailed analysis are available after sign-in.