CVE-2026-71033 in Commerce Experience Manager
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager, specifically affecting version 11.4.0. This software suite is designed to provide enterprise-grade search capabilities and content management features for large-scale e-commerce platforms. The flaw represents a critical security weakness that undermines the integrity of the authentication and authorization mechanisms governing access to sensitive application data. By exploiting this vulnerability, an attacker can bypass expected security controls, leading to unauthorized retrieval or manipulation of information stored within the system.
The technical nature of this flaw allows for exploitation by low-privileged attackers who have already established a logon session on the infrastructure hosting the Oracle Commerce services. This indicates that the vulnerability is not remotely exploitable over the network without prior authentication but rather requires local access to the server environment or an adjacent compromised host within the same trust zone. The attacker leverages this existing foothold to interact with the Endeca Application Controller in a manner that circumvents standard permission checks. Once triggered, the flaw enables the extraction of critical data that should remain restricted to higher-privileged administrative accounts or specific application roles.
The operational impact of successfully exploiting this vulnerability is significant regarding confidentiality and potential downstream effects on system integrity. The primary consequence is unauthorized access to critical business data, which may include customer information, transaction records, product catalogs, and proprietary search indexes. In severe cases, the attacker gains complete access to all Oracle Commerce Guided Search accessible data. This level of exposure can lead to substantial financial loss, regulatory non-compliance with standards such as GDPR or PCI-DSS due to personal data leakage, and reputational damage for the affected organization. Although the CVSS 3.1 base score is rated at 5.5 indicating medium severity, the impact on confidentiality is classified as high, reflecting the sensitivity of the compromised assets.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management or CWE-862 Missing Authorization, depending on whether the issue stems from insufficient role verification or flawed access control logic within the application controller. In terms of adversary behavior, it corresponds to ATT&CK technique T1078 Valid Accounts, as exploitation requires legitimate but low-level credentials, and potentially T1530 Data from Cloud Storage if the data is accessed via cloud-integrated endpoints. The attack vector AV:L denotes Local access, while PR:L signifies Low privileges are required for initial compromise.
Mitigation strategies should focus on strict network segmentation to limit local or lateral movement opportunities within the infrastructure hosting Oracle Commerce services. Administrators must ensure that only essential personnel have logon rights to these servers and enforce multi-factor authentication where applicable. Additionally, applying the latest security patches provided by Oracle is paramount, as vendors typically release updates to address such privilege escalation flaws in subsequent maintenance releases. Regular auditing of user permissions and monitoring for anomalous data access patterns can also help detect exploitation attempts early. Organizations should review their internal network architecture to ensure that low-privileged accounts do not have unnecessary proximity to critical application servers containing sensitive commerce data.