CVE-2026-70991: Oracle Commerce Authentication Bypass Vulnerability

CVE-2026-70991 Overview

CVE-2026-70991 affects the Content Acquisition System component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager version 11.4.0. The vulnerability enables an unauthenticated attacker with local logon access to the infrastructure to compromise the affected products. Exploitation requires user interaction from a person other than the attacker.

Successful exploitation results in unauthorized access to critical data or full access to all data reachable by Oracle Commerce Guided Search and Experience Manager. The flaw involves a scope change, meaning attacks can affect resources beyond the vulnerable component. Oracle addressed the issue in Security Alert CSPUAUG2026.

Critical Impact
An attacker with local access can trick a legitimate user into an action that discloses confidential Oracle Commerce data and pivots impact into additional connected products.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Oracle Commerce Content Acquisition System (component)

Discovery Timeline

2026-08-18 - CVE-2026-70991 published to NVD
2026-08-20 - Last updated in NVD database
Oracle Security Alert CSPUAUG2026 - Oracle publishes patch guidance (Oracle Security Alert CSPUAUG2026)

Technical Details for CVE-2026-70991

Vulnerability Analysis

The issue is classified as an Improper Access Control weakness [CWE-284] in the Content Acquisition System (CAS) of Oracle Commerce Guided Search and Experience Manager. CAS is the component responsible for crawling, extracting, and processing content from source systems before publication to the storefront search index.

The vulnerability requires local access to the host running Oracle Commerce, no authentication, and user interaction from a separate victim. The scope change indicates that exploitation crosses the trust boundary of the vulnerable component, allowing the attacker to reach data owned by other products or subsystems.

The confidentiality impact is high while integrity and availability are unaffected. The bug behaves as an information-disclosure primitive rather than a code-execution or tampering primitive.

Root Cause

Oracle does not publish detailed root-cause information in its Critical Patch Update advisories. Based on the CWE-284 classification, the Content Acquisition System fails to correctly enforce access restrictions on data or interfaces it exposes on the local host. An unauthenticated local process can leverage a legitimate user action to obtain data it should not be able to read.

Attack Vector

Exploitation requires local access to the Oracle Commerce infrastructure. The attacker stages content or interfaces that a privileged user must interact with. When the victim performs the required action, the access-control gap in CAS exposes protected data to the attacker's context, including data belonging to related Oracle Commerce products through the scope change. No verified public proof-of-concept is available for CVE-2026-70991. Refer to the Oracle Security Alert CSPUAUG2026 for advisory-level details.

Detection Methods for CVE-2026-70991

Indicators of Compromise

Unexpected process activity or file access under the Oracle Commerce CAS service account on the local host
Access to CAS crawl output, record stores, or configuration files by non-Oracle Commerce processes
Anomalous user interactions with CAS administration interfaces initiated shortly after a local logon event

Detection Strategies

Enable auditing on CAS installation directories, record store paths, and CAS crawl configuration files to identify unauthorized read access
Correlate local interactive logon events on Oracle Commerce hosts with subsequent CAS process activity to surface staged attacks
Alert on execution of unsigned or unexpected binaries in the Oracle Commerce runtime user context

Monitoring Recommendations

Forward Oracle Commerce application logs, CAS server logs, and host security logs to a centralized analytics platform for correlation
Baseline normal administrator interaction patterns with Experience Manager and Guided Search consoles and alert on deviations
Track file integrity of CAS configuration and pipeline definitions to detect attacker-controlled content designed to trigger the flaw

How to Mitigate CVE-2026-70991

Immediate Actions Required

Apply the patch referenced in Oracle Security Alert CSPUAUG2026 to Oracle Commerce Guided Search and Experience Manager 11.4.0
Restrict local logon rights on Oracle Commerce hosts to a minimal set of administrators
Review and reduce the number of users authorized to interact with CAS administration interfaces

Patch Information

Oracle released fixes for CVE-2026-70991 as part of the August 2026 Critical Patch Update / Security Alert cycle. Administrators should review the Oracle Security Alert CSPUAUG2026 advisory and apply the specified patches for Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0. There are no vendor-published workarounds; patching is the supported remediation path.

Workarounds

Isolate Oracle Commerce servers on a management network and disallow interactive local logon for non-administrative users until the patch is applied
Require multi-factor authentication and privileged access management for any account authorized to log on to Oracle Commerce infrastructure
Educate administrators about the user-interaction requirement so they avoid actions on untrusted content originating from the local host

bash

# Configuration example: restrict interactive logon on the Oracle Commerce host (Linux)
# Limit SSH access to a dedicated administrators group
sudo groupadd oracle-commerce-admins
sudo usermod -aG oracle-commerce-admins <admin_user>

# /etc/ssh/sshd_config
AllowGroups oracle-commerce-admins
PermitRootLogin no
PasswordAuthentication no

sudo systemctl restart sshd