CVE-2026-70993

HighCVSS 8.2

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Content Acquisition System) version 11.4.0. An unauthenticated attacker can cause system hang or frequent crashes (complete DoS) and unauthorized modification of some data via HTTP.

Risk Assessment

Risk includes denial of service and unauthorized data modification, potentially disrupting services.

Recommendation

Apply Oracle patches and secure the Content Acquisition System component against unauthorized network access.

Original NVD description (English source)

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager as well as unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).