CVE-2026-70994
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker via HTTP can gain unauthorized access to critical data or all product data and cause a hang or frequent crashes (complete DoS).
Risk Assessment
High risk of data confidentiality breach and service availability. Attack may lead to critical information leakage and system downtime.
Recommendation
Apply Oracle-provided patches for version 11.4.0. Restrict HTTP access to trusted networks only.
Other vulnerabilities in Oracle Commerce Endeca Application Controller
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS