Description
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Endeca Application Controller component of Oracle Commerce Guided Search allows an attacker who can send HTTP requests to compromise the platform with high impact on confidentiality and integrity. The vulnerability is easily exploitable and lets an unauthenticated user create, delete, or modify critical data, or gain full read access to all data exposed by the application.

Affected Systems

Oracle Corporation's Oracle Commerce Guided Search and Oracle Commerce Experience Manager, version 11.4.0, are affected.

Risk and Exploitability

The CVSS 3.1 base score of 9.1 indicates critical severity, with no exploitation restrictions noted. The EPSS score is < 1%, and the vulnerability has not yet been listed in CISA’s KEV catalog. Because the flaw is reachable through HTTP and does not require authentication, attackers with network access can exploit it without additional privileges. The existing attack path permits full data compromise, making the risk high for any environment that hosts the vulnerable component.

Generated by OpenCVE AI on August 22, 2026 at 07:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official Oracle patch or upgrade to a fixed version of Oracle Commerce Guided Search / Oracle Commerce Experience Manager as soon as it is released.
  • If an update is not yet available, restrict inbound HTTP traffic to the Endeca Application Controller by configuring firewalls or network ACLs to allow only trusted IP addresses.
  • Review and tighten data access controls within the application, removing any unnecessary user privileges and enabling audit logging to detect unauthorized activity.

Generated by OpenCVE AI on August 22, 2026 at 07:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle commerce Experience Manager
Oracle commerce Guided Search
CPEs cpe:2.3:a:oracle:commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:commerce_guided_search:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle commerce Experience Manager
Oracle commerce Guided Search

Sat, 22 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Commerce Guided Search
Weaknesses CWE-284

Sat, 22 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle commerce Guided Search / Oracle Commerce Experience Manager
Vendors & Products Oracle commerce Guided Search / Oracle Commerce Experience Manager

Fri, 21 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Commerce Guided Search
Weaknesses CWE-284

Fri, 21 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Modification and Deletion Vulnerability via HTTP in Oracle Commerce Guided Search
Weaknesses CWE-284

Thu, 20 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Modification and Deletion Vulnerability via HTTP in Oracle Commerce Guided Search
Weaknesses CWE-284

Thu, 20 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Deletion via Unauthenticated HTTP Access in Oracle Commerce Guided Search
Weaknesses CWE-284

Wed, 19 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Deletion via Unauthenticated HTTP Access in Oracle Commerce Guided Search
Weaknesses CWE-284

Wed, 19 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Commerce Guided Search
Weaknesses CWE-200
CWE-285

Wed, 19 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Commerce Guided Search
Weaknesses CWE-200
CWE-285

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
CPEs cpe:2.3:a:oracle:commerce_guided_search_\/_oracle_commerce_experience_manager:11.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle commerce Guided Search \/ Oracle Commerce Experience Manager
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Commerce Experience Manager Commerce Guided Search Commerce Guided Search / Oracle Commerce Experience Manager Commerce Guided Search \/ Oracle Commerce Experience Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-22T03:47:51.367Z

Reserved: 2026-08-04T22:06:34.611Z

Link: CVE-2026-71015

cve-icon Vulnrichment

Updated: 2026-08-22T03:47:46.557Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:00.877

Modified: 2026-08-24T16:28:54.580

Link: CVE-2026-71015

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T08:00:13Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function