CVE-2026-70994: Oracle Commerce Auth Bypass Vulnerability

CVE-2026-70994 Overview

CVE-2026-70994 is a critical vulnerability in the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager, version 11.4.0. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the product without user interaction. Successful exploitation grants unauthorized access to all accessible data and can cause a complete denial of service through repeatable crashes or hangs. The underlying weakness is classified as improper access control [CWE-284].

Critical Impact
An unauthenticated remote attacker can exfiltrate all data reachable by Oracle Commerce Guided Search and force a complete denial of service against the Endeca Application Controller.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Endeca Application Controller component

Discovery Timeline

2026-08-18 - CVE-2026-70994 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70994

Vulnerability Analysis

The vulnerability resides in the Endeca Application Controller (EAC), the administrative component that orchestrates provisioning, configuration, and operational control of Oracle Commerce Guided Search deployments. The EAC exposes HTTP-accessible interfaces that fail to enforce sufficient access control on privileged operations. An unauthenticated attacker reaching the EAC endpoint over the network can invoke functionality that should be restricted to administrators.

Successful exploitation produces two distinct outcomes. First, the attacker obtains unauthorized access to all data accessible to the affected product, including catalog data, indexed content, and configuration artifacts. Second, the attacker can trigger a hang or a frequently repeatable crash of the service, resulting in complete denial of service.

The attack requires no privileges and no user interaction. The Endeca Application Controller is typically deployed as an internal service, so exposure depends on network segmentation practices around the Oracle Commerce environment.

Root Cause

The root cause is improper access control [CWE-284] on HTTP-reachable Endeca Application Controller functionality. Authorization checks are missing or insufficient for operations that read sensitive data and operations that manipulate service state.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted HTTP requests to the Endeca Application Controller listener without any authentication material. No user interaction is required, and the attack complexity is low. Refer to the Oracle Security Alert for the vendor's technical guidance.

// No verified public exploit code is available at time of writing.
// Refer to the Oracle Security Alert for authoritative technical details.

Detection Methods for CVE-2026-70994

Indicators of Compromise

Unexpected HTTP requests to the Endeca Application Controller ports from untrusted source addresses.
Sudden restarts, hangs, or repeated crash signatures in EAC service logs consistent with denial of service.
Anomalous outbound data transfers from hosts running Oracle Commerce Guided Search components.

Detection Strategies

Inspect HTTP access logs for unauthenticated calls to EAC administrative paths and correlate with source reputation.
Baseline EAC process uptime and alert on abnormal termination or restart frequency.
Monitor for large or unusual responses returned from EAC endpoints indicative of bulk data retrieval.

Monitoring Recommendations

Forward EAC and web-tier logs into a centralized analytics platform with alerting on authentication anomalies.
Enable network flow monitoring between application servers and EAC hosts to detect lateral scanning.
Track file integrity and configuration changes on Oracle Commerce servers hosting Endeca components.

How to Mitigate CVE-2026-70994

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert for August 2026 without delay.
Restrict network access to the Endeca Application Controller so only trusted management hosts can reach its HTTP ports.
Audit EAC logs for evidence of prior unauthenticated access attempts against administrative endpoints.

Patch Information

Oracle addressed CVE-2026-70994 in the August 2026 Critical Patch Update. Administrators should apply the fix for Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 as documented in the Oracle Security Alert.

Workarounds

Place the Endeca Application Controller behind a firewall or reverse proxy that enforces source-address allowlisting.
Terminate exposure of EAC HTTP ports to any untrusted network segment, including DMZ zones.
Enforce network-layer authentication such as mutual TLS or VPN access for administrative traffic to Oracle Commerce infrastructure.

bash

# Example iptables rule restricting EAC HTTP access to a management subnet
iptables -A INPUT -p tcp --dport 8888 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP