CVE-2026-70995: Oracle Commerce Auth Bypass Vulnerability

CVE-2026-70995 Overview

CVE-2026-70995 is a critical vulnerability in the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager. The affected version is 11.4.0. An unauthenticated attacker with network access via HTTP can compromise the application without user interaction. Successful exploitation results in full takeover of the Oracle Commerce Guided Search and Experience Manager environment, impacting confidentiality, integrity, and availability. The flaw is categorized under CWE-284 (Improper Access Control).

Critical Impact
Remote unauthenticated attackers can take over Oracle Commerce Guided Search / Experience Manager instances over HTTP with no user interaction.

Affected Products

Oracle Commerce Guided Search, version 11.4.0
Oracle Commerce Experience Manager, version 11.4.0
Endeca Application Controller component

Discovery Timeline

2026-08-18 - CVE-2026-70995 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70995

Vulnerability Analysis

The vulnerability resides in the Endeca Application Controller (EAC), a component that manages provisioning, deployment, and control of Oracle Commerce Guided Search instances. Improper access control on HTTP-facing interfaces allows an unauthenticated actor to reach privileged administrative functions. This defect maps to CWE-284: Improper Access Control.

Exploitation does not require credentials, user interaction, or elevated privileges. An attacker only needs network reachability to the EAC HTTP service. Successful exploitation yields full compromise of the Guided Search and Experience Manager application, including catalog data, search configuration, and any downstream integrations.

Root Cause

The root cause is missing or insufficient authorization checks on Endeca Application Controller HTTP endpoints. Administrative operations exposed by the controller do not properly validate the identity or permissions of the requester. As a result, sensitive control-plane actions execute in response to anonymous HTTP requests.

Attack Vector

Attackers reach the EAC service over HTTP from any network position with connectivity to the affected host. No authentication material, phishing lure, or client-side vector is required. Because Guided Search deployments frequently sit adjacent to storefront and catalog systems, a successful takeover can pivot into product data manipulation, credential theft, or persistence in the eCommerce stack.

No public proof-of-concept or exploit code is currently listed for this CVE. Refer to the Oracle Security Alert for authoritative technical details.

Detection Methods for CVE-2026-70995

Indicators of Compromise

Unauthenticated HTTP requests to Endeca Application Controller endpoints, particularly administrative or provisioning URLs.
Unexpected creation, modification, or deletion of Endeca applications, scripts, or components.
New or unusual processes spawned by the Endeca service account on affected hosts.
Outbound network connections from the EAC host to unfamiliar external addresses.

Detection Strategies

Review EAC and web server access logs for anonymous requests to control endpoints returning HTTP 200 responses.
Alert on modifications to Endeca configuration files, deployment templates, and application definitions outside change windows.
Correlate process execution telemetry from the Guided Search host with baseline behavior to surface anomalous child processes.

Monitoring Recommendations

Forward EAC, web tier, and OS logs to a centralized SIEM for retention and correlation.
Monitor for privilege changes and new service accounts on Guided Search servers.
Track egress traffic from Commerce infrastructure to detect data exfiltration attempts.

How to Mitigate CVE-2026-70995

Immediate Actions Required

Apply the fixes published in the Oracle Security Alert (August 2026) as the primary remediation.
Restrict network access to the Endeca Application Controller so that only authorized management hosts can reach its HTTP interface.
Audit EAC logs for signs of prior unauthenticated access or configuration tampering.
Rotate credentials, API keys, and integration secrets accessible from the Guided Search environment.

Patch Information

Oracle addresses this vulnerability in the August 2026 Critical Patch Update and Security Alert cycle. Consult the Oracle Security Alert for the specific patch, applicability matrix, and post-installation validation steps for Oracle Commerce Guided Search and Experience Manager 11.4.0.

Workarounds

Place the Endeca Application Controller behind a reverse proxy or firewall that enforces authentication and source IP allow-listing.
Disable or block external exposure of EAC administrative HTTP endpoints until patches are applied.
Segment Oracle Commerce infrastructure from general corporate and internet-facing networks to reduce attacker reachability.

bash

# Example: restrict EAC HTTP port to a management subnet using iptables
iptables -A INPUT -p tcp --dport 8888 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP