CVE-2026-70980CWE-284broken-access-control

CVE-2026-70980

Critical · published August 19, 2026

CVSS v3.1
9.0
EPSS
0%
Percentile
32.2
In the wild
Unconfirmed
What it is

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00392 · 32.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-19T01:17Z
Affected products (2)
ProductVersionsFixed in
oracle/commerce_experience_managerall versions—
oracle/commerce_guided_searchall versions—
References (1)
https://www.oracle.com/security-alerts/cspuaug2026.html · [email protected]
EPSS history
Timeline
  • 18 AUG 21:02Z
    Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System)
    cvelistv5