What is the CVSS score of CVE-2026-71034?

CVE-2026-71034 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Commerce are affected by CVE-2026-71034?

Oracle Commerce Guided Search and Experience Manager 11.4.0 contains a high-severity authentication bypass allowing unauthenticated remote attackers to read all accessible data via the Forge SOAP…

How to fix or mitigate CVE-2026-71034?

Within 24 hours: Identify all instances of Oracle Commerce Guided Search/Experience Manager 11.4.0 in production and non-production environments and map their network accessibility status. Within 7 days: Confirm with Oracle Support whether a patch is available beyond initial advisory information, implement firewall rules to restrict SOAP interface access to internal networks only, and enable detailed logging on the Forge component. Within 30 days: Upgrade to a patched Oracle Commerce version, deploy WAF rules to block or authenticate SOAP requests to the vulnerable component, and audit data access logs for evidence of unauthorized reads.

Oracle Commerce CVE-2026-71034

EUVD-2026-61981 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-cghf-vrh6-9v88

Authentication Bypass Oracle Commerce Guided Search Commerce Experience Manager

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible SOAP endpoint, no credentials or interaction required, high confidentiality loss bounded to application scope, no integrity or availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:15 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated remote attackers can fully read all data accessible to Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 by exploiting an authentication bypass in the Forge component's SOAP interface, requiring no credentials, no user interaction, and no elevated access. Disclosed as part of Oracle's August 2026 Critical Security Patch Update (CSPU), the flaw is tagged as an Authentication Bypass targeting the SOAP protocol with a CVSS 3.1 base score of 7.5. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires only network access to the SOAP interface of the Forge component in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0; no credentials, no user interaction, and no special configuration are required per the CVSS PR:N, UI:N, AC:L metrics. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) places this firmly in the high-severity tier: network-accessible, zero complexity, no authentication, no user interaction, with complete confidentiality loss within the application's data scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Security Patch Update for August 2026 as published at https://www.oracle.com/security-alerts/cspuaug2026.html; this advisory is the authoritative source for the fix targeting the Forge component authentication bypass in version 11.4.0. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all instances of Oracle Commerce Guided Search/Experience Manager 11.4.0 in production and non-production environments and map their network accessibility status. …

Threat intelligence, references, and detailed analysis are available after sign-in.