Description
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the Content Acquisition System of Oracle Commerce Guided Search and Oracle Commerce Experience Manager, allowing an unauthenticated attacker with network access via HTTP to compromise the application. The flaw is an instance of improper access control (CWE‑284). Successful exploitation can lead to a full takeover of the application, compromising confidentiality, integrity, and availability.

Affected Systems

Oracle Corporation’s Oracle Commerce Guided Search and Oracle Commerce Experience Manager, version 11.4.0. No other affected versions are listed at this time.

Risk and Exploitability

The CVSS 3.1 base score of 9.0 indicates high severity, with an attack vector over the network via HTTP, high complexity, no authentication, and a change in scope that may affect additional Oracle products. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting that present exploitation is rare but the potential impact remains significant.

Generated by OpenCVE AI on August 21, 2026 at 03:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check Oracle’s Security Alerts and download the latest patch or hotfix for Oracle Commerce 11.4.0, then apply it immediately.
  • If a fix is not yet available, restrict HTTP access to the application by firewalling or VPN so that only trusted networks can reach the service.
  • Continuously monitor application and network logs for anomalous HTTP traffic or error messages that could indicate exploitation attempts.

Generated by OpenCVE AI on August 21, 2026 at 03:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle commerce Experience Manager
Oracle commerce Guided Search
CPEs cpe:2.3:a:oracle:commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:commerce_guided_search:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle commerce Experience Manager
Oracle commerce Guided Search

Fri, 21 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Title Oracle Commerce Guided Search Vulnerability Enabling Unauthenticated Remote Takeover

Thu, 20 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Title Unrestricted HTTP Access Enables Full Application Takeover in Oracle Commerce Guided Search

Wed, 19 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 19 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Title Unrestricted HTTP Access Enables Full Application Takeover in Oracle Commerce Guided Search
Weaknesses CWE-287
CWE-95

Wed, 19 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-95

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
CPEs cpe:2.3:a:oracle:commerce_guided_search_\/_oracle_commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
References
Metrics cvssV3_1

{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Commerce Experience Manager Commerce Guided Search Commerce Guided Search \/ Oracle Commerce Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T16:09:43.275Z

Reserved: 2026-08-04T22:06:34.609Z

Link: CVE-2026-70980

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:56.820

Modified: 2026-08-24T16:46:00.790

Link: CVE-2026-70980

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T03:15:03Z

Weaknesses