Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Appli…

Published 2 mo ago 2026-08-18 · modified 16 d ago 2026-10-22 · JSON

CVSS

5.5

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.2%

percentile 5%

Public exploits

none known

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 mo ago 2026-08-20

Exploit prediction (EPSS)

0.15% probability of exploitation in the next 30 days, higher than 5% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	5.5	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
CNA	3.1	5.5	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Affected products

Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager

Classification

Weakness

CWE-284 Improper Access Control

References

oracle.com /security-alerts/cspuaug2026.html · vendor-advisory

Sources

CVE List: CVE-2026-71033
NVD: CVE-2026-71033

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary