What is the CVSS score of CVE-2026-71026?

CVE-2026-71026 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-71026?

Oracle Commerce Guided Search/Experience Manager 11.4.0 contains an unauthenticated remote authentication bypass that exposes all application-accessible data to unauthorized read and modification…

How to fix or mitigate CVE-2026-71026?

Within 24 hours, isolate affected systems from untrusted networks and implement firewall rules to restrict traffic to the Endeca Application Controller component to authorized IP addresses only. Within 7 days, contact Oracle for available mitigation configurations or hardening options, and audit all systems running Commerce Guided Search/Experience Manager 11.4.0 to identify what sensitive data they process and their network exposure. Within 30 days, establish and begin execution of an upgrade plan to a patched version once available from Oracle, or evaluate alternative e-commerce platforms if remediation timeline is unacceptable.

Oracle Commerce CVE-2026-71026

EUVD-2026-61973 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-95wc-2ffc-5xm6

Authentication Bypass Oracle Commerce Experience Manager Commerce Guided Search

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated auth bypass reachable over HTTP with no user interaction gives AV:N/AC:L/PR:N/UI:N; broad read and write to app data gives C:H/I:H, with no availability impact so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:17 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote, unauthenticated attacker reach the Endeca Application Controller component over HTTP and read or tamper with all data accessible to the application. Rated CVSS 3.1 9.1 (C:H/I:H, no availability impact), it is trivially exploitable with no user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network HTTP reachability to the Endeca Application Controller component of Oracle Commerce Guided Search / Experience Manager 11.4.0 - that is the specific attack surface. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All available signals point to genuine high priority rather than an inflated CVSS number: the vector AV:N/AC:L/PR:N/UI:N describes remote, unauthenticated, low-complexity exploitation with no user interaction, and the confirmed impact is High confidentiality and High integrity (A:N, so no denial-of-service dimension). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the fixes in Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html) - Patch available per vendor advisory; Oracle does not publish a discrete fixed build number for this entry beyond the CPU, so apply the CPU patch set for Oracle Commerce 11.4.0 rather than an invented version. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, isolate affected systems from untrusted networks and implement firewall rules to restrict traffic to the Endeca Application Controller component to authorized IP addresses only. …

Threat intelligence, references, and detailed analysis are available after sign-in.