Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-70993: Oracle Commerce Guided Search / Experience Manager Crash and Data Access Risk

CVE-2026-70993 · published 2 months ago

Summary

An attacker can crash the Oracle Commerce Guided Search / Experience Manager system and gain unauthorized access to some data. This affects version 11.4.0 of Oracle Commerce Guided Search / Experience Manager. It's essential to update to a fixed version to prevent these issues.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle corporation	oracle commerce guided search / oracle commerce experience manager	11.4.0

Original advisory text

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected ...

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager as well as unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

References

https://www.oracle.com/security-alerts/cspuaug2026.html vendor-advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.2 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

Timeline

Published18 Aug 2026

Updated4 Nov 2026

First seen18 Aug 2026

Sources

CVE-2026-70993 · NVD

CVE-2026-70993 · MITRE

Track software like this

Free during beta