CVE-2026-71032 in Commerce Guided Search
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager, specifically affecting version 11.4.0. This security flaw is characterized by its ease of exploitation, allowing an unauthenticated attacker to compromise the system through network access via HTTP without requiring any user interaction or prior authentication credentials. The nature of this vulnerability suggests a critical weakness in how the application controller processes incoming requests, potentially due to insufficient input validation or improper authorization checks within the web service interface that exposes internal data structures and management functions to external networks.
The operational impact of this flaw is significant because it enables unauthorized modifications to accessible data, including updates, inserts, and deletes, as well as unauthorized read access to a subset of sensitive information stored by Oracle Commerce Guided Search or Experience Manager. This dual impact on both confidentiality and integrity means that an attacker can not only exfiltrate critical business data but also alter the state of the application, potentially disrupting service availability or manipulating search results and user experiences for legitimate customers. The CVSS 3.1 base score of 7.2 reflects this high severity, driven by the low attack complexity, lack of required privileges, and network-based exploitability vector.
A critical aspect of this vulnerability is its potential to cause a scope change in security impact. Although the flaw originates within Oracle Commerce Guided Search or Experience Manager, successful exploitation may allow an attacker to pivot into other connected products or underlying infrastructure components that share trust relationships with these systems. This lateral movement capability amplifies the risk beyond the immediate application layer, potentially leading to broader system compromise across the enterprise environment if proper network segmentation and isolation are not enforced between commerce platforms and backend databases or authentication services.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as it allows unauthenticated access to sensitive functions, and likely involves CWE-918 Server-Side Request Forgery (SSRF) or CWE-601 URL Redirection to Untrusted Site if the exploitation relies on manipulating request parameters. In terms of adversary tactics, this aligns with MITRE ATT&CK technique T1190 Exploit Public-Facing Application and potentially T1530 Data from Cloud Storage Object if the accessed data resides in connected object stores. The lack of user interface requirements further simplifies automated exploitation by threat actors seeking to rapidly compromise vulnerable instances at scale.
Mitigation strategies must prioritize immediate remediation through applying vendor-provided patches or updates that address the specific flaw within the Endeca Application Controller. In cases where patching is not immediately feasible, organizations should implement strict network access controls to restrict HTTP traffic to this component only from trusted internal subnets rather than exposing it directly to the public internet. Additionally, deploying Web Application Firewalls with rulesets designed to detect and block anomalous request patterns associated with unauthenticated data manipulation can provide a layer of defense-in-depth. Regular vulnerability scanning and penetration testing focused on authentication bypasses are recommended to ensure that no other similar weaknesses exist within the broader Oracle Commerce ecosystem.