External risk intelligence

Oracle Commerce Guided Search Experience Manager Unauthorized Access and Denial of Service Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-70994

Oracle Commerce Guided Search/Experience Manager is typically deployed as a customer-facing web application or e-commerce platform component. As it provides web-based search and experience management, it is commonly accessible via the public internet to support user interaction and online storefront functionality.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Commerce Guided Search and Experience Manager products. This issue, exploitable remotely by unauthenticated attackers, could lead to unauthorized access to sensitive data or disruption of service through crashes. The primary concern is to confirm if these Oracle Commerce components are in use and assess any potential exposure.

Unauthenticated remote access to critical data or service disruption.
Critical remote access and service disruption risks.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending network requests to Oracle Commerce Guided Search/Experience Manager. This could lead to unauthorized access to sensitive data or a denial-of-service condition.

Network access required.
HTTP requests trigger vulnerability.
Data access and denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact critical data within Oracle Commerce Guided Search and Experience Manager. An attacker with network access could potentially gain unauthorized access to all accessible data or cause the system to crash repeatedly.

Critical data in Oracle Commerce.
Unauthorized network access.
System data loss or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given this vulnerability in Oracle Commerce Guided Search and Experience Manager, application owners and platform teams are likely responsible for addressing it. The first practical step is to identify all instances of this software, determine their accessibility and business criticality, and locate the accountable owner for each. This will allow for risk-based remediation planning and vendor coordination.

Application and Platform Teams own the issue.
Verify product reachability and business impact.
Plan remediation with vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Commerce Guided Search?

Oracle Commerce Guided Search, formerly known as Endeca, is an enterprise-grade search and navigation platform. Organizations use it to power sophisticated, faceted search experiences on e-commerce websites, allowing users to filter products and find information quickly. The Endeca Application Controller component acts as a management layer for running these search services.

How does CVE-2026-70994 impact system security?

This vulnerability allows an unauthenticated user to interact with the system in ways they should not. It essentially functions as an unauthorized access and denial-of-service issue. It may permit a remote attacker to view sensitive information stored within the application or crash the service, making the search functionality unavailable to your customers.

Does this CVE require specific attacker actions?

Yes, the vulnerability is triggered by sending specially crafted HTTP network requests to the affected Endeca Application Controller. Because it does not require authentication, an attacker does not need a valid username or password to attempt the attack. However, simply having the software installed in a non-networked or isolated environment would not allow this trigger path to succeed.

Is my instance of Oracle Commerce at risk?

According to Halo Surface Signal, this software is often deployed as a customer-facing web application to support public online storefronts. Because these platforms are frequently accessible via the public internet to facilitate user interaction, they are more likely to be reachable by external attackers. If your instance is exposed to the internet, it is considered high-priority.

What is the first step to address this threat?

Begin by auditing your infrastructure to create a definitive inventory of all Oracle Commerce Guided Search instances. Verify which of these instances are reachable from the internet versus those confined to internal networks. Once mapped, identify the specific business owners for each application to coordinate updates and risk mitigation steps according to official vendor guidance.

References

www.oracle.com/security-alerts/cspuaug2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.