External risk intelligence

Oracle Commerce Guided Search and Experience Manager Vulnerability Allows Unauthorized Data Access and Modification

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-70998

The component is part of an e-commerce platform management layer that supports network-accessible HTTP interfaces. Such applications are commonly deployed as web-facing services to manage storefront content and search experiences, making them reachable via the internet in typical enterprise e-commerce deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Oracle Commerce's Guided Search and Experience Manager components, which could allow an unauthenticated attacker with network access to compromise the system. Successful exploitation could lead to unauthorized access to critical data or unauthorized modifications of data within the affected Oracle Commerce components.

Unauthenticated network access can compromise Oracle Commerce.
Important for understanding potential data access and modification.
Confirm relevance and exposure to Oracle Commerce deployments.

Attack Path

How an attacker could exploit the issue

An attacker can target an unauthenticated vulnerability in Oracle Commerce Guided Search or Experience Manager by sending network requests over HTTP. This could allow them to gain unauthorized access to sensitive data or modify existing information within the system.

Network access required.
Triggers through HTTP requests.
Risk of data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to gain unauthorized access to critical data within Oracle Commerce Guided Search and Oracle Commerce Experience Manager. The attacker may also be able to update, insert, or delete some of this data.

Critical data in the affected product.
Via network access over HTTP.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Commerce platform's Endeca Application Controller is susceptible to a critical vulnerability, requiring immediate attention from platform or infrastructure teams responsible for Oracle Commerce deployments. The first step should be to identify all instances of the affected product, assess their exposure to network access via HTTP, and determine their business criticality to prioritize remediation efforts. Coordination with Oracle for patching or mitigation strategies will be essential.

Platform and infrastructure teams own resolution.
Verify HTTP reachability and business criticality.
Coordinate with Oracle for remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Commerce Guided Search?

It is a platform used to power e-commerce search and navigation experiences. The Endeca Application Controller component acts as a management layer that handles the configuration and orchestration of these search environments, enabling administrators to control how storefront data is indexed, organized, and served to users.

What does CVE-2026-70998 mean?

This identifier refers to a critical security flaw in the Endeca Application Controller. It describes a weakness where the system fails to properly verify the identity of someone sending requests. Because of this, an attacker can bypass security controls to read, change, or delete sensitive information managed by the software without needing a login.

How is this vulnerability triggered?

The vulnerability is triggered when an attacker sends specific, unauthorized HTTP network requests to the affected system. It is important to note that the issue relies on network connectivity; simply having the software installed on a disconnected or air-gapped machine does not automatically trigger the bug without a reachable network path for those HTTP requests.

Is my Oracle Commerce environment at risk?

Halo Surface Signal indicates that these components often include web-facing interfaces to support storefront management. If your deployment is reachable via the internet, it is at higher risk. Even if hosted internally, any segment where unauthorized users can route HTTP traffic to the Endeca Application Controller should be considered potentially vulnerable.

What should I do to address this issue?

Begin by auditing your infrastructure to locate all instances of version 11.4.0. Prioritize checking which of these are reachable over a network, particularly those exposed to broader traffic. Once identified, consult official Oracle security documentation to obtain the necessary updates or mitigation guidance to secure your environment.

References

www.oracle.com/security-alerts/cspuaug2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.