External risk intelligence

Oracle Commerce Guided Search / Experience Manager Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-70995

The component is part of an Oracle Commerce platform, which typically functions as a web-facing e-commerce application. The vulnerability is reachable via HTTP by an unauthenticated attacker, indicating it is designed to be accessible over a network, making it a likely candidate for public internet exposure in many standard commerce deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Oracle Commerce software could allow an attacker to completely take over the system without needing any credentials. This issue affects the Endeca Application Controller component, which is part of Oracle Commerce Guided Search and Experience Manager. The high severity score indicates significant potential impacts on confidentiality, integrity, and availability.

System takeover possible with no login.
Business-critical commerce systems are at risk.
Confirm if this Oracle Commerce component is used.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to the affected Oracle Commerce product. Since no authentication is required, an unauthenticated user with network access can trigger the vulnerability, potentially leading to a complete takeover of the system.

Attacker needs network access.
Unauthenticated HTTP requests trigger it.
Full system takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to compromise the Oracle Commerce Guided Search or Experience Manager. Successful attacks could lead to a complete takeover of these components, potentially impacting the availability and integrity of e-commerce operations.

E-commerce search and experience platform.
Unauthenticated network access.
Complete system takeover possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Oracle Commerce Guided Search and Oracle Commerce Experience Manager, components commonly found in e-commerce platforms. Given the network-accessible nature and critical impact, the initial focus should be on identifying all instances of this software, assessing their business criticality and external reachability, and then confirming the accountable team—likely a combination of application owners, infrastructure, and security teams—to prioritize and plan remediation.

Application and infrastructure teams own the issue.
Verify external reachability and business criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Commerce Guided Search used for?

It is an e-commerce platform component that powers advanced search and site navigation features for online stores. The Endeca Application Controller, specifically affected here, acts as a core management layer that orchestrates these search and experience services, ensuring that product data and site interactions are processed and delivered efficiently to shoppers.

What kind of security weakness is CVE-2026-70995?

This CVE describes a critical vulnerability that allows for a complete system takeover. In security terms, this indicates a failure in authentication or input validation controls within the Endeca Application Controller. Because it is labeled as easily exploitable without credentials, it implies the system does not properly restrict access to sensitive management functions, allowing an attacker to gain full control over the application's operations.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by sending specially crafted HTTP requests directly to the affected service over the network. Crucially, the attacker does not need to possess any valid login credentials to initiate this process. The vulnerability is not triggered by standard, legitimate user actions, but rather requires the specific malicious request pattern that the component fails to sanitize or verify.

Is my instance of Oracle Commerce at risk?

Halo Surface Signal indicates that because this component is part of a web-facing e-commerce platform, it is often deployed in internet-accessible environments. If your specific instance of Oracle Commerce Guided Search or Experience Manager is reachable over the public internet, it is at higher risk. Internal-only instances are also technically affected, but public-facing deployments are the primary concern for this type of network-based attack.

What should I do first to address this vulnerability?

Begin by identifying every instance of Oracle Commerce Guided Search and Experience Manager in your environment to understand your total footprint. Determine which of these systems are critical to your e-commerce operations and confirm their network reachability. Once mapped, coordinate with your infrastructure and application owners to review vendor security guidance and plan the necessary remediation steps to secure the Endeca Application Controller.

References

www.oracle.com/security-alerts/cspuaug2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.