CVE-2026-70995: Oracle Commerce Auth Bypass Vulnerability

CVE-2026-70995 Overview

CVE-2026-70995 is a critical access control vulnerability [CWE-284] in the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager. The affected version is 11.4.0. An unauthenticated attacker with network access via HTTP can exploit this flaw to fully compromise the product. Successful exploitation results in complete takeover of Oracle Commerce Guided Search and Oracle Commerce Experience Manager, impacting confidentiality, integrity, and availability. Oracle published the fix in the Oracle Security Alert CSPUAug2026.

Critical Impact
Unauthenticated remote attackers can take over Oracle Commerce Guided Search and Experience Manager deployments over the network with low attack complexity.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Endeca Application Controller component

Discovery Timeline

2026-08-18 - CVE-2026-70995 published to NVD
2026-08-18 - Oracle releases Security Alert CSPUAug2026
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70995

Vulnerability Analysis

The vulnerability resides in the Endeca Application Controller (EAC), the administrative service that manages Endeca application lifecycle operations across Oracle Commerce Guided Search and Experience Manager. The flaw is categorized as improper access control [CWE-284], meaning the component fails to enforce authorization on HTTP-accessible functionality.

An attacker reaching the EAC over HTTP does not need credentials or user interaction to trigger the flaw. Because the EAC controls provisioning, configuration, and orchestration of Endeca application components, unauthorized access translates directly into product takeover. This includes read, modify, and disruption capabilities across catalog data and search infrastructure.

Oracle rates the flaw as easily exploitable, and the impacts span confidentiality, integrity, and availability of the affected product.

Root Cause

The root cause is missing or insufficient access control on the Endeca Application Controller's network-exposed interface. Requests that should require authenticated administrative context are processed without proper authorization checks, allowing anonymous callers to invoke privileged operations.

Attack Vector

Exploitation occurs over the network via HTTP against the EAC endpoint. The attacker does not require prior authentication, user interaction, or elevated privileges. Any host with network reachability to the EAC service on a vulnerable Oracle Commerce 11.4.0 deployment is a viable target. No verified public proof-of-concept code was available at the time of publication.

Detection Methods for CVE-2026-70995

Indicators of Compromise

Unexpected HTTP requests to the Endeca Application Controller service from unauthenticated or external sources.
Unauthorized administrative operations in EAC logs, including component provisioning, script execution, or configuration changes.
New or modified Endeca application definitions, pipelines, or MDEX resources without a corresponding change ticket.
Outbound network activity from Oracle Commerce hosts to unfamiliar destinations following EAC activity.

Detection Strategies

Inspect EAC access logs for anonymous HTTP requests invoking administrative operations.
Correlate process-execution telemetry on Oracle Commerce servers with EAC command invocations to identify unauthorized child processes.
Alert on file modifications to Endeca configuration directories and application deployment paths outside change windows.
Baseline normal EAC client sources and flag deviations, especially requests originating outside the management network.

Monitoring Recommendations

Forward EAC and web server logs to a centralized analytics platform for retention and correlation.
Monitor authentication and authorization failures on Oracle Commerce management interfaces.
Track outbound connections and new listening ports on hosts running Guided Search and Experience Manager.
Enable file integrity monitoring on Endeca binaries, scripts, and application XML definitions.

How to Mitigate CVE-2026-70995

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUAug2026 to all Oracle Commerce Guided Search and Experience Manager 11.4.0 deployments.
Restrict network access to the Endeca Application Controller to a dedicated management network or bastion hosts.
Audit EAC and web server logs for unauthenticated administrative activity since the affected component was deployed.
Rotate credentials, API keys, and integration secrets stored within or accessible to Endeca applications.

Patch Information

Oracle addressed the vulnerability in the out-of-cycle Security Alert CSPUAug2026. Administrators should download and apply the patch bundle from My Oracle Support that corresponds to Oracle Commerce Guided Search / Experience Manager 11.4.0. Consult the Oracle Security Alert CSPUAug2026 for the authoritative patch mapping and installation notes.

Workarounds

Block external HTTP access to the EAC port at the perimeter firewall and reverse proxy layer.
Enforce source IP allowlisting on the EAC service so only known administrative workstations can connect.
Place Oracle Commerce management interfaces behind a VPN or zero-trust access broker until patches are applied.
Disable unused Endeca administrative endpoints where operationally feasible.

bash

# Example: restrict EAC port access with iptables to a management CIDR
iptables -A INPUT -p tcp --dport 8888 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP