CVE-2026-70986

HighCVSS 7.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. An unauthenticated attacker can gain unauthorized access to critical data via HTTP.

Risk Assessment

Risk includes unauthorized access to critical data, potentially leading to confidentiality breach.

Recommendation

Apply Oracle patches and secure the Content Acquisition System component against unauthorized network access.

Original NVD description (English source)

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).