CVE-2026-70997
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker via HTTP can gain unauthorized access to critical data or all product data and cause a hang or frequent crashes (complete DoS).
Risk Assessment
High risk of data confidentiality breach and service availability. Attack may lead to critical information leakage and system downtime.
Recommendation
Apply Oracle-provided patches for version 11.4.0. Restrict HTTP access to trusted networks only.
Other vulnerabilities in Oracle Commerce Experience Manager
See all- CVE-2026-71012High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A low-privileged attacker can remotely (HTTP) gain unauthorized access to critical data or all product data and cause partial denial of service.
- CVE-2026-71011Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71010High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker with local access to the infrastructure, requiring user interaction, can take over the product.
- CVE-2026-71009High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. Difficult to exploit, but an unauthenticated attacker via HTTP can modify, delete, or create data and gain unauthorized access to critical data.
- CVE-2026-71008Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A high-privileged attacker can exploit it via HTTP, potentially impacting other products (scope change). Successful attack leads to unauthorized access to critical data or complete access to all data.
- CVE-2026-71007Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A high-privileged attacker can exploit it via HTTP, potentially impacting other products (scope change). Successful attack leads to unauthorized access to critical data or complete access to all data.
- CVE-2026-71006Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71005Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71004Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71003High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A low-privileged attacker can remotely (HTTP) gain unauthorized access to critical data or all product data and cause partial denial of service.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS