CVE-2026-71033: Medium severity Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager vulnerability

Published Aug 18, 2026

Updated

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Affected Software

3 affected components

Oracle Oracle Commerce Guided Search / Oracle Commerce Experience Manager=11.4.0

Oracle Commerce Experience Manager=11.4.0

Oracle Commerce Guided Search=11.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller) to a version that resolves this vulnerability.
Fixed in 11.4.0

Event History

Aug 18, 2026

CVE Published

via MITRE·09:03 PM

Data Sourced

via MITRE·09:03 PM

DescriptionSeverity

Data Sourced

via NVD·09:18 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to exploitation?

The affected supported version is 11.4.0. An attacker must have a low-privileged account and logon access to the infrastructure where the product executes; the attack vector is local rather than network-based.

What is the potential impact of a successful attack?

A successful attacker can gain unauthorized access to critical data or complete access to data accessible to Oracle Commerce Guided Search / Oracle Commerce Experience Manager. The stated impact is confidentiality only, with no integrity or availability impact indicated.

Does exploitation require user interaction or complex conditions?

No user interaction is required, and the vulnerability is described as easily exploitable with low attack complexity. The attacker does, however, need prior low-privileged authenticated access to the hosting infrastructure.