CVE-2026-70996: Oracle Commerce Authentication Bypass Flaw

CVE-2026-70996 Overview

CVE-2026-70996 is an improper access control vulnerability [CWE-284] in the Endeca Application Controller component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager. The affected version is 11.4.0. An unauthenticated attacker with network access over HTTP can exploit this flaw without user interaction. Successful exploitation grants unauthorized access to critical data across all data accessible through Oracle Commerce Guided Search and Oracle Commerce Experience Manager. The scope is changed, meaning attacks may impact additional products beyond the vulnerable component. Oracle disclosed the issue in the Critical Patch Update Advisory for August 2026.

Critical Impact
Unauthenticated network attackers can read all data accessible to Oracle Commerce Guided Search, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Commerce Guided Search 11.4.0
Oracle Commerce Experience Manager 11.4.0
Endeca Application Controller (component)

Discovery Timeline

2026-08-18 - CVE-2026-70996 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database
August 2026 - Oracle publishes Security Alert CSPUAUG2026 addressing the issue

Technical Details for CVE-2026-70996

Vulnerability Analysis

The vulnerability resides in the Endeca Application Controller, the administrative component that manages Oracle Commerce Guided Search deployments. The controller exposes functionality over HTTP without enforcing sufficient authentication or authorization checks. An attacker sends crafted network requests to the controller and obtains data that should require privileged access.

The flaw is classified as improper access control [CWE-284]. Oracle rates the confidentiality impact as high, with no direct integrity or availability impact. Because the scope is changed, the compromised component can influence resources under a different security authority, which broadens the blast radius across integrated Oracle Commerce products.

Oracle describes the vulnerability as easily exploitable and reachable without credentials or user interaction. This combination makes internet-exposed Endeca Application Controller instances high-value targets for data theft.

Root Cause

The Endeca Application Controller does not adequately restrict access to sensitive operations or data endpoints. Requests that should be gated behind authentication or role checks are processed based on network reachability alone. Refer to Oracle Security Alert CSPUAUG2026 for vendor technical details.

Attack Vector

The attack is executed remotely over HTTP against the Endeca Application Controller service. No credentials, prior foothold, or victim interaction are required. An attacker locates an exposed controller endpoint, issues crafted HTTP requests, and enumerates or retrieves data managed by Oracle Commerce Guided Search and Experience Manager. No verified public exploit code is available at the time of publication, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.287%.

Detection Methods for CVE-2026-70996

Indicators of Compromise

Unauthenticated HTTP requests to Endeca Application Controller endpoints originating from external or unexpected internal sources
HTTP 200 responses to administrative or data-retrieval paths that normally require authentication
Anomalous volumes of GET requests against Endeca configuration, application, or content endpoints
Access log entries from IP addresses that have never previously interacted with Oracle Commerce infrastructure

Detection Strategies

Review Endeca Application Controller access logs for requests lacking authentication headers followed by successful responses
Baseline normal administrative traffic and alert on deviations in request rate, source, or path patterns
Correlate web application firewall telemetry with Endeca server logs to identify probing activity

Monitoring Recommendations

Enable verbose HTTP request logging on all Endeca Application Controller instances
Forward Oracle Commerce logs to a central SIEM for correlation with network telemetry
Monitor egress traffic from Endeca servers for unusual data volumes that may indicate exfiltration

How to Mitigate CVE-2026-70996

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUAUG2026 to all Oracle Commerce Guided Search and Experience Manager 11.4.0 deployments
Inventory all Endeca Application Controller instances and confirm none are reachable from untrusted networks
Audit HTTP access logs for suspicious unauthenticated requests dating back to the vulnerability disclosure
Rotate credentials and secrets that may have been retrievable through the exposed component

Patch Information

Oracle addressed CVE-2026-70996 in Security Alert CSPUAUG2026. Administrators should download and apply the patch bundle listed in the advisory for Oracle Commerce Guided Search and Oracle Commerce Experience Manager version 11.4.0. Consult the Oracle Security Alert CSPUAUG2026 for exact patch identifiers and installation prerequisites.

Workarounds

Restrict network access to the Endeca Application Controller so only administrative hosts and jump servers can reach it
Place the controller behind a reverse proxy or web application firewall that enforces authentication before requests reach the application
Segment Oracle Commerce infrastructure from internet-facing systems using firewall rules and private VLANs
Disable or block external HTTP access to the controller until the vendor patch is applied

bash

# Example iptables rule limiting Endeca Application Controller access to a trusted admin subnet
iptables -A INPUT -p tcp --dport 8006 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8006 -j DROP