CVE-2026-71030 in Experience Manager
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager, specifically affecting version 11.4.0. This security flaw represents a critical weakness in the application's access control mechanisms, allowing for unauthorized interaction with sensitive data stores without requiring any form of authentication or user interface mediation. The vulnerability is characterized by its ease of exploitation, as it can be triggered remotely over HTTP by an unauthenticated attacker who has network connectivity to the target system. This lack of required credentials significantly lowers the barrier to entry for malicious actors, enabling them to bypass standard security boundaries that are typically designed to protect enterprise commerce platforms from external threats.
From a technical perspective, this flaw aligns with CWE-287, which describes Improper Authentication, and potentially CWE-915, Improvement of Improper Control of Dynamically-Managed Code Resources, depending on the specific implementation details of how the controller handles incoming requests without validating identity or permissions. The vulnerability allows an attacker to perform unauthorized update, insert, or delete operations against accessible data within the Oracle Commerce environment. Furthermore, it grants unauthorized read access to a subset of this data. This dual impact on both integrity and confidentiality indicates that the flaw is not merely informational but poses a direct threat to the operational state and security posture of the affected systems. The ability to modify database records or application states remotely can lead to defacement, data corruption, or the injection of malicious content into customer-facing interfaces.
The operational impact of this vulnerability extends beyond the immediate scope of Oracle Commerce Guided Search due to a potential scope change in attack scenarios. While the technical flaw is located within the Endeca Application Controller, successful exploitation may allow an attacker to pivot and compromise additional products that rely on or are integrated with the commerce platform. This lateral movement capability amplifies the risk profile significantly, as it can lead to broader system compromise across the enterprise infrastructure. The CVSS 3.1 base score of 7.2 reflects a High severity rating, driven by the network-based attack vector, low complexity, and absence of required privileges or user interaction. The specific impact metrics highlight Low confidentiality loss but significant integrity impacts, suggesting that while data might be exposed, the ability to alter system state is the primary concern for administrators.
To mitigate this vulnerability, organizations must immediately apply the latest security patches provided by Oracle for version 11.4.0 of the affected products. Until patching is feasible, it is critical to restrict network access to the Endeca Application Controller interfaces using firewall rules or web application firewalls that block unauthenticated HTTP requests targeting known vulnerable endpoints. Implementing strict input validation and enforcing authentication requirements on all administrative and data-access APIs can also help mitigate exploitation attempts. Additionally, monitoring for anomalous database activity patterns associated with bulk updates or unauthorized deletions can aid in early detection of active exploitation. Regular security assessments and penetration testing should be conducted to identify similar access control weaknesses across the broader Oracle Commerce ecosystem, ensuring that scope changes do not lead to unexpected lateral movement by attackers.