CVE-2026-71010
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker with local access to the infrastructure, requiring user interaction, can take over the product.
Risk Assessment
Risk of full system takeover, potentially leading to complete compromise of data and services.
Recommendation
Apply Oracle patches, restrict local access to the infrastructure, and educate users about interacting with unknown files.
Other vulnerabilities in Oracle Commerce Experience Manager
See all- CVE-2026-70997Critical
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker via HTTP can gain unauthorized access to critical data or all product data and cause a hang or frequent crashes (complete DoS).
- CVE-2026-71012High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A low-privileged attacker can remotely (HTTP) gain unauthorized access to critical data or all product data and cause partial denial of service.
- CVE-2026-71011Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71009High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. Difficult to exploit, but an unauthenticated attacker via HTTP can modify, delete, or create data and gain unauthorized access to critical data.
- CVE-2026-71008Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A high-privileged attacker can exploit it via HTTP, potentially impacting other products (scope change). Successful attack leads to unauthorized access to critical data or complete access to all data.
- CVE-2026-71007Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A high-privileged attacker can exploit it via HTTP, potentially impacting other products (scope change). Successful attack leads to unauthorized access to critical data or complete access to all data.
- CVE-2026-71006Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71005Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71004Medium
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. An unauthenticated attacker can exploit it via HTTP, but requires user interaction. The attack may impact other products (scope change) and result in unauthorized update, insert, delete, and read access to some data.
- CVE-2026-71003High
Vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager) version 11.4.0. A low-privileged attacker can remotely (HTTP) gain unauthorized access to critical data or all product data and cause partial denial of service.
Original NVD description (English source)
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS