What is the CVSS score of EUVD-2026-61979?

EUVD-2026-61979 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Commerce are affected by EUVD-2026-61979?

Organizations using Oracle Commerce platform 11.4.0 face immediate customer data breach and system integrity risks from an unauthenticated remote vulnerability in the Endeca Application Controller.

How to fix or mitigate EUVD-2026-61979?

Within 24 hours: Audit your infrastructure to identify all instances of Oracle Commerce Guided Search and Experience Manager 11.4.0; determine which systems are internet-accessible or process production customer data. Immediately enable detailed access logging on all instances. Within 7 days: Implement network segmentation to restrict Endeca Application Controller access to authorized internal systems only; institute IP-based access controls and VPN requirements; establish daily log review procedures and alerts for suspicious data queries. Within 30 days: Engage Oracle support to verify upgrade availability to patched versions; if no patch exists in your licensed version, evaluate the business risk of keeping the system segmented versus operational costs of migration or decommissioning.

Oracle Commerce EUVD-2026-61979

| CVE-2026-71032 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-2xxc-j494-rh45

Authentication Bypass Oracle Commerce Guided Search Commerce Experience Manager

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Network-reachable HTTP endpoint, no auth required per description and tags, scope change to downstream systems, bounded read/write impact with no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:15 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

AnalysisAI

Unauthenticated remote exploitation of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via HTTP allows attackers to read a subset of accessible data and perform unauthorized data modification (insert, update, delete) through the Endeca Application Controller component. The scope change indicator in the CVSS vector (S:C) signals that successful attacks can impact systems beyond the directly targeted instance. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The vulnerability requires network access to the Oracle Commerce Guided Search / Oracle Commerce Experience Manager instance via HTTP, specifically to the Endeca Application Controller component. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.2 reflects a meaningful but bounded impact - confidentiality and integrity are both affected at Low severity, with no availability impact, but the scope change elevates the score by capturing lateral blast radius. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Security Patch Update (CPU) published at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Audit your infrastructure to identify all instances of Oracle Commerce Guided Search and Experience Manager 11.4.0; determine which systems are internet-accessible or process production customer data. …

Threat intelligence, references, and detailed analysis are available after sign-in.