CVE-2026-70996

HighCVSS 8.6

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Endeca Application Controller) version 11.4.0. An unauthenticated attacker can gain unauthorized access to critical data via HTTP, with potential scope change affecting other products.

Risk Assessment

Risk includes unauthorized access to critical data, and due to scope change, the attack may impact other systems in the organization.

Recommendation

Apply Oracle patches and monitor HTTP traffic to the Endeca Application Controller component.

Original NVD description (English source)

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).