CVE-2026-71001

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A low-privileged attacker can exploit it via HTTP, leading to unauthorized access to critical data or complete access to all data.

Risk Assessment

Risk includes compromise of data confidentiality, including critical data. Attack requires low privileges, increasing the risk of exploitation by internal users.

Recommendation

Apply Oracle patches for version 11.4.0. Restrict user privileges and monitor access to the Experience Manager component.

Original NVD description (English source)

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).