CVE-2026-70976: Oracle Commerce Guided Search DOS Vulnerability

CVE-2026-70976 Overview

CVE-2026-70976 is a broken access control vulnerability [CWE-284] in the Content Acquisition System component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager. The affected version is 11.4.0. An unauthenticated attacker with network access over HTTP can compromise the product without user interaction. Successful exploitation permits unauthorized creation, modification, or deletion of critical data and can trigger a complete denial of service through a hang or repeatable crash. Oracle disclosed the issue in its August 2026 security alert.

Critical Impact
Remote, unauthenticated attackers can tamper with all accessible data and force a full outage of Oracle Commerce Guided Search / Experience Manager 11.4.0.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Content Acquisition System component

Discovery Timeline

2026-08-18 - CVE-2026-70976 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-70976

Vulnerability Analysis

The flaw resides in the Content Acquisition System (CAS), the ingestion pipeline responsible for crawling source content, applying manipulators, and publishing records to the Guided Search index. Because access control is improperly enforced on network-reachable CAS endpoints, an attacker can invoke privileged operations without presenting credentials.

An attacker who reaches the CAS service over HTTP can issue requests that modify, create, or delete records that drive the Guided Search index and Experience Manager storefront. The same request surface allows an attacker to submit inputs that hang or crash the service, producing a complete outage of catalog search and merchandising functionality.

The vulnerability affects integrity and availability but not confidentiality. Attack complexity is low and no user interaction is required, which broadens the pool of potential attackers to any host with network reachability to the CAS listener. The EPSS probability for this issue is 0.3%.

Root Cause

The root cause is improper access control [CWE-284] on CAS operations. Sensitive administrative or content-manipulation functions are exposed without adequate authentication or authorization checks. Oracle has not published deeper technical detail beyond the August 2026 security alert.

Attack Vector

The attack vector is network based. An attacker sends crafted HTTP requests to the CAS service exposed by an affected Oracle Commerce deployment. No credentials, no privileges, and no user interaction are required. Refer to the Oracle Security Alert August 2026 for the vendor's published remediation guidance.

Detection Methods for CVE-2026-70976

Indicators of Compromise

Unexpected HTTP requests to CAS administrative or record-store endpoints from untrusted source addresses.
Unplanned record creation, modification, or deletion events in Guided Search index logs without a corresponding change-management ticket.
Repeated CAS process crashes, hangs, or automatic restarts correlated with inbound HTTP traffic bursts.
Storefront anomalies such as missing catalog entries, altered merchandising rules, or search-result corruption.

Detection Strategies

Enable HTTP access logging on the CAS listener and alert on requests from sources outside the documented administrator network.
Baseline normal CAS ingestion patterns and detect deviations in record volume, frequency, or origin.
Correlate CAS service restarts with upstream HTTP traffic to identify probing or exploitation attempts.

Monitoring Recommendations

Forward CAS, application server, and reverse-proxy logs to a centralized SIEM for retention and correlation.
Monitor availability of the CAS service and Guided Search index publication jobs to detect denial-of-service conditions early.
Track integrity of published index records with periodic hash or checksum comparisons against a trusted source.

How to Mitigate CVE-2026-70976

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert August 2026 as soon as change windows permit.
Restrict network access to CAS listeners so that only authorized administrative hosts can reach the service over HTTP.
Audit CAS record stores and index publications for unauthorized changes since the vulnerability publication date.
Rotate any shared credentials or tokens used by CAS integrations if tampering is suspected.

Patch Information

Oracle addressed CVE-2026-70976 in the August 2026 Critical Patch Update cycle. Administrators should review the Oracle Security Alert August 2026 advisory for the applicable patch bundles for Oracle Commerce Guided Search and Experience Manager 11.4.0 and apply them following Oracle's documented procedure.

Workarounds

Place the CAS service behind a reverse proxy or web application firewall that enforces authentication and source-IP allow-listing until patches are deployed.
Block inbound HTTP access to CAS ports at the perimeter and internal segmentation firewalls for all non-administrative sources.
Disable or isolate the CAS service on internet-exposed hosts if immediate patching is not possible.

bash

# Configuration example: restrict CAS listener to admin subnet via iptables
iptables -A INPUT -p tcp --dport 8500 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8500 -j DROP