Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge).

Published 2 mo ago 2026-08-18 · modified 17 d ago 2026-10-22 · JSON

CVSS

8.1

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 34%

Public exploits

none known

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 mo ago 2026-08-20

Exploit prediction (EPSS)

0.39% probability of exploitation in the next 30 days, higher than 34% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	8.1	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	8.1	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager

Classification

Weakness

CWE-284 Improper Access Control

References

oracle.com /security-alerts/cspuaug2026.html · vendor-advisory

Sources

CVE List: CVE-2026-71035
NVD: CVE-2026-71035

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary