CVE-2026-70989: Medium severity Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager vulnerability
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Systems running the affected supported version 11.4.0 are exposed if a low-privileged attacker can log on to the infrastructure where the product executes. The attack is local and does not require user interaction.
What level of access does an attacker need?
An attacker needs low privileges and a logon to the underlying infrastructure hosting Oracle Commerce Guided Search / Oracle Commerce Experience Manager. No additional user interaction is required.
What could a successful attacker access?
Successful exploitation can provide unauthorized access to critical data or complete access to data accessible by Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The vulnerability may also significantly affect additional products because the CVSS scope is changed.